CVE-2026-29054: Traefik Auth Bypass Vulnerability

CVE-2026-29054 Overview

CVE-2026-29054 is an Input Validation Error vulnerability in Traefik, a widely-used HTTP reverse proxy and load balancer. The vulnerability exists in how Traefik handles the Connection header in relation to X-Forwarded headers during HTTP/1.1 request processing. Due to inconsistent case sensitivity handling, remote unauthenticated attackers can bypass header protection mechanisms and strip security-critical forwarded identity headers from requests.

Critical Impact
Remote unauthenticated attackers can bypass Traefik's header protection to remove X-Forwarded headers (X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port), potentially enabling IP spoofing, access control bypass, and audit trail manipulation in backend applications.

Affected Products

Traefik versions 2.11.9 through 2.11.37
Traefik versions 3.1.3 through 3.6.8

Discovery Timeline

2026-03-05 - CVE-2026-29054 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-29054

Vulnerability Analysis

This vulnerability stems from a case sensitivity mismatch in Traefik's HTTP/1.1 request handling logic (CWE-178: Improper Handling of Case Sensitivity). Traefik implements protective measures to prevent clients from manipulating X-Forwarded headers through the HTTP Connection header hop-by-hop removal mechanism. However, the implementation contains a critical flaw: while the protection compares Connection header tokens case-sensitively against protected header names, the actual header deletion operation executes case-insensitively.

This inconsistency allows attackers to craft malicious HTTP requests that bypass the protection entirely. For example, Traefik may protect X-Real-Ip from removal, but a Connection header containing x-real-ip (lowercase) would pass the case-sensitive check while still triggering case-insensitive deletion of the actual header.

The practical impact is significant for organizations relying on Traefik-managed forwarded headers for client identification, access control, or logging. Backend applications trusting these headers could be deceived about the true origin of requests, potentially bypassing IP-based access controls or corrupting audit logs.

Root Cause

The root cause is improper handling of case sensitivity (CWE-178) in the header protection mechanism. The vulnerability arises from two operations using different case comparison strategies: the security check uses case-sensitive string comparison, while the header removal operation uses case-insensitive matching as defined by HTTP specifications. This semantic mismatch creates a bypass condition.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP/1.1 requests to a Traefik instance with Connection headers containing lowercase versions of protected X-Forwarded header names. When Traefik processes these requests, the protection mechanism fails to recognize the lowercase tokens as matching the protected headers, but the subsequent header removal operation successfully deletes them due to case-insensitive matching.

This allows the attacker to strip legitimate forwarded headers that Traefik would have set, potentially causing backend services to receive requests without proper client identification information or with attacker-controlled values in those headers.

Detection Methods for CVE-2026-29054

Indicators of Compromise

HTTP requests containing lowercase X-Forwarded header names in the Connection header (e.g., Connection: x-real-ip)
Backend application logs showing missing X-Forwarded headers for requests that should contain them
Unexpected values or absence of client IP information in access logs
Anomalous patterns in requests where X-Forwarded headers are inconsistent with network topology

Detection Strategies

Implement network monitoring to detect HTTP requests with Connection headers referencing X-Forwarded header variants
Deploy WAF rules to alert on or block Connection headers containing forwarded header references
Enable verbose logging in Traefik to capture full request headers for forensic analysis
Configure backend applications to validate and log discrepancies in X-Forwarded header presence

Monitoring Recommendations

Monitor Traefik access logs for requests with unusual Connection header patterns
Set up alerts for backend applications receiving requests without expected X-Forwarded headers
Track version information across Traefik deployments to identify vulnerable instances
Correlate network layer client IP addresses with application layer X-Forwarded-For values to detect tampering

How to Mitigate CVE-2026-29054

Immediate Actions Required

Upgrade Traefik 2.11.x installations to version 2.11.38 or later immediately
Upgrade Traefik 3.x installations to version 3.6.9 or later immediately
Review backend application logic that relies on X-Forwarded headers for security decisions
Audit access logs for evidence of exploitation attempts using lowercase Connection header tokens

Patch Information

Traefik has released patched versions that address this case sensitivity vulnerability. The fix ensures consistent case-insensitive comparison when checking Connection header tokens against protected header names.

Traefik 2.x: Upgrade to version 2.11.38
Traefik 3.x: Upgrade to version 3.6.9

For detailed information about the vulnerability and remediation, see the GitHub Security Advisory GHSA-92mv-8f8w-wq52.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block or sanitize requests with Connection headers containing X-Forwarded header references
Configure upstream network infrastructure to normalize or strip Connection headers before they reach Traefik
Implement backend application-level validation that does not solely rely on X-Forwarded headers for security decisions
Consider using Traefik middleware to explicitly set and enforce X-Forwarded headers regardless of client input

bash

# Example: Verify Traefik version to confirm patch status
traefik version
# Ensure output shows version 2.11.38+ or 3.6.9+