CVE-2026-26998: Traefik ForwardAuth DoS Vulnerability

CVE-2026-26998 Overview

CVE-2026-26998 is a Denial of Service vulnerability in Traefik, an HTTP reverse proxy and load balancer. The vulnerability exists in Traefik's handling of ForwardAuth middleware responses, where response bodies from authentication servers are read entirely into memory without any size limit. When an authentication server returns an unexpectedly large or unbounded response body, Traefik allocates unlimited memory, potentially causing an out-of-memory (OOM) condition that crashes the process. This results in a denial of service for all routes served by the affected Traefik instance.

Critical Impact

A malicious or compromised authentication server can crash Traefik instances by returning oversized responses, causing complete service disruption for all proxied routes.

Affected Products

• Traefik versions prior to 2.11.38
• Traefik versions prior to 3.6.9

Discovery Timeline

• March 5, 2026 - CVE-2026-26998 published to NVD
• March 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26998

Vulnerability Analysis

This vulnerability stems from improper resource allocation control in Traefik's ForwardAuth middleware implementation. When Traefik is configured to delegate authentication decisions to an external authentication server via the ForwardAuth middleware, it forwards requests to the authentication endpoint and processes the responses. The critical flaw lies in how Traefik handles these authentication server responses—specifically, the response body is read completely into memory without enforcing any size constraints.

The absence of a maxResponseBodySize configuration option means there is no mechanism for administrators to restrict the amount of data Traefik will accept from authentication servers. This design oversight creates a resource exhaustion attack vector that can be exploited to trigger out-of-memory conditions.

Root Cause

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Traefik's ForwardAuth middleware lacks proper bounds checking when reading authentication server response bodies. The implementation does not implement memory allocation limits, allowing unbounded data to be loaded into process memory. This architectural oversight violates secure coding principles for handling untrusted or semi-trusted external input.

Attack Vector

The attack vector is network-based and requires the attacker to either control or compromise an authentication server configured with Traefik's ForwardAuth middleware. An attacker with high privileges (such as control over the authentication infrastructure) can configure the authentication server to return extremely large response bodies. When Traefik processes these responses, it attempts to allocate memory for the entire payload, eventually exhausting available system memory and triggering an OOM kill of the Traefik process.

The attack scenario involves the following flow: A client makes a request to a Traefik-proxied endpoint that uses ForwardAuth → Traefik forwards the authentication request to the external auth server → The malicious auth server responds with an extremely large response body → Traefik attempts to read the entire response into memory → Memory exhaustion occurs, crashing the Traefik process and disrupting all proxied services.

Detection Methods for CVE-2026-26998

Indicators of Compromise

• Sudden memory spikes in Traefik container or process metrics correlating with authentication requests
• OOM killer events in system logs targeting Traefik processes
• Repeated Traefik restarts or crashes without clear application errors
• Abnormally large response sizes from authentication servers in network traffic logs

Detection Strategies

• Monitor Traefik process memory utilization and set alerts for rapid memory growth patterns
• Implement network monitoring to detect unusually large HTTP responses from authentication endpoints
• Configure container orchestration platforms to alert on OOM events affecting Traefik pods
• Review Traefik access logs for authentication patterns preceding crash events

Monitoring Recommendations

• Enable memory profiling and resource monitoring for all Traefik instances using ForwardAuth
• Implement rate limiting and response size monitoring on authentication server infrastructure
• Configure health checks with appropriate timeouts to detect unresponsive Traefik instances quickly
• Set up centralized logging to correlate authentication traffic with resource consumption anomalies

How to Mitigate CVE-2026-26998

Immediate Actions Required

• Upgrade Traefik to version 2.11.38 or 3.6.9 immediately depending on your deployment branch
• Audit all ForwardAuth middleware configurations to identify potentially affected routes
• Implement resource limits (memory constraints) on Traefik containers or processes as a defense-in-depth measure
• Review and validate the trustworthiness of all configured authentication servers

Patch Information

Traefik has addressed this vulnerability in versions 2.11.38 and 3.6.9. The patches introduce proper bounds checking for authentication server response bodies. Administrators should upgrade to these versions or later to remediate the vulnerability. For detailed information, refer to the GitHub Security Advisory GHSA-fw45-f5q2-2p4x, Traefik v2.11.38 Release, and Traefik v3.6.9 Release.

Workarounds

• Implement a reverse proxy or API gateway in front of authentication servers to enforce response size limits
• Configure network-level controls to limit response payload sizes from authentication endpoints
• Deploy Traefik with strict memory limits via container orchestration (e.g., Kubernetes resource limits) to prevent system-wide impact
• Consider implementing authentication caching to reduce the frequency of ForwardAuth requests

# Example Kubernetes resource limits for Traefik deployment
# Add to your Traefik deployment spec to limit memory impact
resources:
  limits:
    memory: "512Mi"
  requests:
    memory: "256Mi"