CVE-2026-33433: Traefik Auth Bypass Vulnerability

CVE-2026-33433 Overview

A security vulnerability has been identified in Traefik, the popular HTTP reverse proxy and load balancer. When the headerField configuration option is set with a non-canonical HTTP header name (e.g., x-auth-user instead of X-Auth-User), an authenticated attacker can exploit this misconfiguration to inject their own canonical version of that header, enabling identity impersonation against backend services.

The vulnerability arises from how Traefik handles HTTP header canonicalization. When a non-canonical header name is configured, the backend receives two header entries — the attacker-injected canonical one is read first, effectively overriding Traefik's non-canonical write. This allows authenticated attackers to impersonate any identity to backend services that rely on these headers for authentication or authorization decisions.

Critical Impact

Authenticated attackers can bypass identity controls and impersonate any user to backend services by exploiting header canonicalization behavior, potentially leading to unauthorized access and privilege escalation.

Affected Products

• Traefik versions prior to 2.11.42
• Traefik versions prior to 3.6.11
• Traefik versions prior to 3.7.0-ea.3

Discovery Timeline

• 2026-03-27 - CVE-2026-33433 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33433

Vulnerability Analysis

This vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing). The issue exists in Traefik's header forwarding mechanism when administrators configure the headerField option with non-canonical HTTP header names.

HTTP header names are case-insensitive according to RFC 7230, but many implementations normalize them to a canonical form (e.g., capitalizing the first letter of each word). When Traefik is configured with a lowercase header like x-auth-user, it writes this non-canonical form to the request forwarded to the backend. However, if an attacker includes the canonical version X-Auth-User in their request, both headers may be present in the forwarded request.

The vulnerability is exploitable because many backend applications and frameworks read the canonical version first when processing headers. This creates a race condition where the attacker's injected header takes precedence over the legitimate header written by Traefik, allowing complete identity spoofing.

Root Cause

The root cause is improper handling of HTTP header canonicalization in Traefik's header forwarding logic. When headerField is configured with a non-canonical header name, Traefik fails to properly sanitize or block incoming requests that contain the canonical equivalent. This allows duplicate headers to reach the backend, where processing order determines which value is used for authentication decisions.

Attack Vector

The attack requires network access and authenticated access to the Traefik proxy. An attacker crafts an HTTP request that includes the canonical version of the authentication header configured in Traefik's headerField setting. The attack flow is as follows:

1. The attacker authenticates to Traefik normally
2. Traefik adds the configured non-canonical header (e.g., x-auth-user: attacker)
3. The attacker injects the canonical header in their request (e.g., X-Auth-User: admin)
4. Both headers are forwarded to the backend
5. The backend reads the canonical header first, treating the attacker as admin

This vulnerability requires knowledge of the header field configuration, but such information may be discoverable through reconnaissance or insider knowledge. For detailed technical information about this attack pattern, see the GitHub Security Advisory GHSA-qr99-7898-vr7c.

Detection Methods for CVE-2026-33433

Indicators of Compromise

• HTTP requests containing duplicate authentication headers with different values (e.g., both x-auth-user and X-Auth-User)
• Backend logs showing user identity mismatches between authentication tokens and header values
• Unusual access patterns where authenticated users appear to access resources belonging to other users

Detection Strategies

• Implement header inspection rules in web application firewalls (WAF) to detect requests with duplicate case-variant headers
• Configure logging on backend services to capture all incoming headers for forensic analysis
• Deploy anomaly detection to identify authentication header inconsistencies
• Audit Traefik configurations for non-canonical headerField settings

Monitoring Recommendations

• Enable verbose request logging in Traefik to capture full header details for incoming and outgoing requests
• Monitor backend authentication logs for identity spoofing indicators
• Set up alerts for requests containing multiple variants of authentication headers
• Review access logs for privilege escalation patterns where lower-privileged users access higher-privileged resources

How to Mitigate CVE-2026-33433

Immediate Actions Required

• Upgrade Traefik to patched versions: 2.11.42, 3.6.11, or 3.7.0-ea.3
• Audit all Traefik configurations for headerField settings using non-canonical header names
• Convert any non-canonical header configurations to use proper canonical form (e.g., X-Auth-User instead of x-auth-user)
• Review backend service logs for signs of exploitation

Patch Information

Traefik has released patched versions that address this header canonicalization vulnerability. Organizations should upgrade to one of the following versions:

• Traefik v2.11.42 for the 2.x branch
• Traefik v3.6.11 for the 3.x stable branch
• Traefik v3.7.0-ea.3 for early access users

The patches ensure proper header handling regardless of the configured header name format.

Workarounds

• Update headerField configuration to use canonical header names (e.g., X-Auth-User instead of x-auth-user)
• Implement backend validation to reject requests with duplicate authentication headers
• Deploy a WAF rule to strip or block requests containing case-variant duplicate headers
• Consider implementing additional backend authentication mechanisms that don't rely solely on header values

# Configuration example - use canonical header names
# Before (vulnerable):
# headerField: x-auth-user

# After (secure):
# headerField: X-Auth-User

# Traefik v2.x update command
docker pull traefik:v2.11.42
# or for Kubernetes/Helm
helm upgrade traefik traefik/traefik --set image.tag=v2.11.42