CVE-2024-52003: Traefik X-Forwarded-Prefix Header Vulnerability

CVE-2024-52003 Overview

Traefik is an HTTP reverse proxy and load balancer widely deployed in cloud-native environments. CVE-2024-52003 allows a client to supply the X-Forwarded-Prefix header from an untrusted source. Traefik accepts and forwards this header without validation, enabling downstream applications to consume attacker-controlled prefix data.

The issue maps to [CWE-601] (URL Redirection to Untrusted Site). Applications that trust X-Forwarded-Prefix for constructing links, redirects, or route decisions may be tricked into exposing users to open-redirect or phishing paths. The vulnerability affects Traefik versions prior to 2.11.14 and 3.2.1.

Critical Impact
Untrusted X-Forwarded-Prefix values propagate to backend services, enabling open-redirect conditions and integrity impact on downstream URL handling.

Affected Products

Traefik versions prior to 2.11.14 (2.x branch)
Traefik versions prior to 3.2.1 (3.x branch)
Deployments using Traefik as an HTTP reverse proxy or ingress controller

Discovery Timeline

2024-11-29 - CVE-2024-52003 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52003

Vulnerability Analysis

Traefik processes the X-Forwarded-* family of headers to preserve client context when proxying requests to backend services. The affected versions accept the X-Forwarded-Prefix header from any client, including untrusted upstream sources, and forward the value to backends without stripping or validating it.

Backend applications commonly use X-Forwarded-Prefix to construct absolute URLs, generate redirects, or build navigation elements. When an attacker controls this value, the resulting URLs can point to attacker-chosen paths or external destinations, producing open-redirect and link-injection conditions.

The vulnerability requires network reachability to the Traefik proxy and no authentication. Exploitation complexity is elevated because success depends on how the downstream application consumes the forwarded prefix.

Root Cause

The root cause is missing input trust boundaries for the X-Forwarded-Prefix header. Traefik did not distinguish between trusted upstream proxies and arbitrary clients when deciding whether to accept and forward the header. The fix in pull request #11253 enforces the same trusted-IP checks already applied to other X-Forwarded-* headers.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to a Traefik-fronted service and includes an X-Forwarded-Prefix header containing an attacker-controlled value. Traefik forwards the header to the backend. If the backend uses the value to build redirect responses or hyperlinks, users following those links reach the attacker's destination while trusting the legitimate hostname.

Exploitation requires no special privileges and no user interaction at the proxy layer. Impact scales with how heavily the backend relies on the forwarded prefix. See the GitHub Security Advisory GHSA-h924-8g65-j9wg for additional detail.

Detection Methods for CVE-2024-52003

Indicators of Compromise

HTTP request logs containing X-Forwarded-Prefix headers with values pointing to external domains or unexpected paths
Backend application logs generating redirects to hostnames outside the organization's allowlist
Anomalous 3xx redirect responses correlated with requests carrying client-supplied X-Forwarded-Prefix headers

Detection Strategies

Inspect Traefik access logs for inbound X-Forwarded-Prefix headers originating from IPs outside the trusted proxy list
Alert on backend responses containing Location headers whose host differs from the request host when a forwarded prefix was present
Correlate WAF logs with backend application logs to identify prefix values containing protocol schemes (http://, https://, //)

Monitoring Recommendations

Enable verbose HTTP header logging on Traefik and forward to a centralized log platform for retention and search
Baseline normal X-Forwarded-Prefix values per route and alert on deviations
Monitor for spikes in outbound redirects from applications sitting behind Traefik

How to Mitigate CVE-2024-52003

Immediate Actions Required

Upgrade Traefik to version 2.11.14 or 3.2.1 or later
Audit backend applications that consume X-Forwarded-Prefix and validate the value against an allowlist before using it in URL construction
Review Traefik forwardedHeaders and trustedIPs configuration to ensure only known upstream proxies are trusted

Patch Information

Traefik addressed the issue in Traefik Release v2.11.14 and Traefik Release v3.2.1. The corrective change is tracked in GitHub Pull Request #11253, which applies trusted-IP enforcement to the X-Forwarded-Prefix header. The vendor advisory states there are no known workarounds; upgrading is required.

Workarounds

No official workarounds are available per the vendor advisory; upgrading is the only supported remediation
As defense-in-depth, configure an upstream WAF or ingress filter to strip inbound X-Forwarded-Prefix headers before they reach Traefik
Harden backend applications to treat X-Forwarded-Prefix as untrusted input and sanitize before use

bash

# Configuration example: restrict trusted forwarding sources in Traefik static config
# entryPoints.web.forwardedHeaders.trustedIPs allows only known upstream proxies
entryPoints:
  web:
    address: ":80"
    forwardedHeaders:
      trustedIPs:
        - "10.0.0.0/8"
        - "192.168.1.0/24"