CVE-2026-54763: Traefik Auth Bypass Vulnerability

CVE-2026-54763 Overview

CVE-2026-54763 is an identity header spoofing vulnerability in Traefik, a widely deployed HTTP reverse proxy and load balancer. The flaw affects the BasicAuth, DigestAuth, and ForwardAuth middlewares in versions prior to v2.11.51, v3.6.22, and v3.7.6. Traefik strips canonical dashed identity headers before writing its own trusted values, but it does not strip underscore-variant header names. Many backends normalize underscores and dashes to the same header, so a spoofed header can survive Traefik's sanitization and reach the upstream service. Attackers reaching a protected route can inject a forged identity or authorization header and impersonate arbitrary users [CWE-178].

Critical Impact
Attackers can bypass authentication middleware and spoof identity or authorization context to backend applications, undermining trust boundaries enforced by Traefik.

Affected Products

Traefik versions prior to v2.11.51
Traefik versions prior to v3.6.22
Traefik versions prior to v3.7.6

Discovery Timeline

2026-07-06 - CVE-2026-54763 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54763

Vulnerability Analysis

Traefik's authentication middlewares are designed to write trusted identity headers to backend requests after successful authentication. To prevent header injection by clients, Traefik strips any incoming client-supplied version of these identity headers before setting its own value. The stripping logic operates on the canonical dashed form of header names, such as X-Forwarded-User or X-Auth-Request-Email.

The vulnerability arises because HTTP header name normalization is not consistent between Traefik and downstream backends. Traefik treats X-Forwarded-User and X_Forwarded_User as distinct header names. Many backend web servers and application frameworks, however, normalize underscores to dashes, treating both as the same logical header. An attacker sending X_Forwarded_User: admin bypasses Traefik's sanitization entirely.

The issue is particularly acute in the ForwardAuth middleware authResponseHeaders path. If the underscore-variant header is not stripped, the attacker's forged value may reach the backend instead of the value Traefik intended to set from the authentication service response.

Root Cause

The root cause is improperly implemented case- and separator-sensitive header stripping [CWE-178]. Traefik matched only canonicalized dashed forms while backends performed broader normalization that folded underscore variants into the same header, allowing a spoofed header to pass through unfiltered.

Attack Vector

The attack is network-based, requires no authentication to Traefik itself beyond reaching a protected route, and requires no user interaction. An attacker sends an HTTP request containing an underscore-variant identity header such as X_Forwarded_User: administrator. Traefik's middleware does not remove it, and the backend interprets it as the authoritative identity header, granting the attacker impersonation of any user or role the backend trusts.

text

// Patch snippet from docs/content/reference/static-configuration/file.toml
// Adds a new option to control handling of request headers containing underscores
       encodeQuerySemicolons = true
       sanitizePath = true
       maxHeaderBytes = 42
+      underscoreHeadersStrategy = "foobar"
       [entryPoints.EntryPoint0.http.redirections]
         [entryPoints.EntryPoint0.http.redirections.entryPoint]
           to = "foobar"

Source: Traefik commit 108a5264

Detection Methods for CVE-2026-54763

Indicators of Compromise

Inbound HTTP requests containing headers with underscores in identity-related names, such as X_Forwarded_User, X_Auth_Request_Email, or X_Remote_User.
Backend application logs showing authenticated activity under user identities that do not match Traefik's authentication middleware audit logs.
Discrepancies between the identity value Traefik intended to set and the identity observed by the backend for the same request ID.

Detection Strategies

Inspect raw HTTP requests at the edge for header names containing underscore characters and correlate with protected routes fronted by BasicAuth, DigestAuth, or ForwardAuth.
Compare identity headers logged by Traefik with those logged by upstream services to identify requests where the backend saw an unexpected identity.
Audit ForwardAuth responses and confirm that authResponseHeaders values delivered to the backend match those returned by the authentication service.

Monitoring Recommendations

Enable verbose access logging on Traefik and forward logs to a centralized analytics platform for correlation with backend authentication events.
Alert on any request carrying underscore-variant identity headers reaching routes protected by authentication middleware.
Monitor for privilege escalation patterns such as unexpected access to administrative endpoints immediately following requests with anomalous header names.

How to Mitigate CVE-2026-54763

Immediate Actions Required

Upgrade Traefik to v2.11.51, v3.6.22, or v3.7.6 or later, matching your current major version branch.
Configure the new underscoreHeadersStrategy option on affected entry points to drop or reject headers containing underscores.
Audit backend services for reliance on identity headers set by Traefik, and re-authenticate any sessions established during the exposure window.

Patch Information

The fix was delivered in Traefik v2.11.51, v3.6.22, and v3.7.6. The patch introduces the underscoreHeadersStrategy entry point option and stops underscore-variant identity headers from bypassing middleware sanitization. Refer to the Traefik Security Advisory GHSA-x677-9fxg-v5c5 and the upstream commit 108a5264 for full details.

Workarounds

If immediate patching is not feasible, place an additional reverse proxy or WAF in front of Traefik that rejects or normalizes any request headers containing underscore characters.
Reconfigure backend applications to only trust identity headers received through a dedicated, mutually authenticated internal channel rather than accepting them from client-facing request headers.
Restrict access to protected routes to trusted network ranges until the patch can be deployed.

bash

# Example: enable underscore header stripping on the affected entry point
# Traefik static configuration (file.toml)
[entryPoints.web.http]
  underscoreHeadersStrategy = "drop"

Source: Traefik integration fixture simple_underscore_headers.toml