CVE-2026-62987: Fabio HTTP Router Auth Bypass Vulnerability

CVE-2026-62987 Overview

Fabio is an HTTP(S) and TCP router used to deploy applications managed by Consul. CVE-2026-62987 affects Fabio versions 1.6.6 through 1.7.1 and stems from an incomplete fix for CVE-2025-48865 in proxy/http_headers.go. The protectHeaders map covers a hardcoded set of forwarded headers but omits operator-configured ClientIPHeader, TLSHeader, and RequestID names. An unauthenticated remote client can name these headers in the inbound Connection header, causing Go's ReverseProxy to strip them before the request reaches the backend. Backends that rely on these trust headers for authorization or auditing lose those signals.

Critical Impact
Unauthenticated attackers can strip operator-configured client-IP, TLS-termination, and request-correlation headers, undermining backend authorization and audit trails.

Affected Products

Fabio versions 1.6.6 through 1.7.1
Deployments enabling proxy.header.clientip, proxy.header.tls, or proxy.header.requestid options
Backends relying on Fabio-injected trust headers for authorization or logging

Discovery Timeline

2026-09-21 - CVE-2026-62987 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-62987

Vulnerability Analysis

The flaw is an authentication-context stripping issue classified as Authentication Bypass by Spoofing [CWE-290]. Fabio's HTTPProxy.ServeHTTP in proxy/http_proxy.go calls addHeaders to set trust headers on the inbound request. Go's standard library ReverseProxy then honors the client-supplied Connection header and removes any headers named within it as hop-by-hop headers. Because protectHeaders only contained the hardcoded forwarded header set, operator-defined header names could be listed by an attacker in Connection and stripped downstream.

Root Cause

The incomplete fix for CVE-2025-48865 did not extend the protectHeaders allowlist to cover operator-configured header names. The map was static and did not incorporate the runtime ClientIPHeader, TLSHeader, or RequestID configuration values, leaving these headers eligible for Connection-based removal.

Attack Vector

An unauthenticated client sends an HTTP request through Fabio containing a Connection header that lists the operator-configured trust header names. Fabio adds the trust headers, but ReverseProxy strips them before forwarding. Backends receive requests without the expected client-IP, TLS, or request-ID signals, potentially bypassing IP-based access controls or breaking audit correlation.

// Patch excerpt: proxy/http_headers.go
}
}

-var protectHeaders = map[string]bool{
+// DefaultProtectHeaders is a map of headers that are protected from Client manipulation.
+var DefaultProtectHeaders = map[string]bool{
 "Forwarded":          true,
 "X-Forwarded-For":    true,
 "X-Forwarded-Host":   true,

Source: GitHub Commit 240526a

Detection Methods for CVE-2026-62987

Indicators of Compromise

Inbound HTTP requests containing a Connection header that lists custom header names matching the deployment's configured proxy.header.clientip, proxy.header.tls, or proxy.header.requestid values.
Backend logs showing missing client-IP, TLS termination, or request-correlation fields on requests routed through Fabio.
Requests bypassing IP allowlists or authorization checks that depend on Fabio-injected headers.

Detection Strategies

Inspect Fabio access logs and upstream traffic for Connection headers that reference non-standard, operator-configured header names.
Correlate authentication and authorization failures at the backend with the absence of expected trust headers.
Run Fabio behind a WAF or reverse proxy that normalizes or blocks Connection headers listing non-hop-by-hop tokens.

Monitoring Recommendations

Alert on unexpected Connection header values seen at the edge, especially those naming known application-specific headers.
Track backend request volume where audit fields (client IP, request ID) are unexpectedly empty.
Review access control decisions that rely on Fabio-set headers for anomalous grants from unauthenticated sources.

How to Mitigate CVE-2026-62987

Immediate Actions Required

Upgrade Fabio to version 1.7.2, which extends DefaultProtectHeaders to include operator-configured header names.
Audit deployments for use of proxy.header.clientip, proxy.header.tls, and proxy.header.requestid and treat any enabled option as an exposure until patched.
Verify backend services do not grant elevated trust based solely on Fabio-injected headers without additional validation.

Patch Information

The fix is available in Fabio v1.7.2. See the GitHub Security Advisory GHSA-fq95-v8xc-jm3v and the GitHub Release v1.7.2 for details. The corrective commit is 240526a.

Workarounds

Leave proxy.header.clientip, proxy.header.tls, and proxy.header.requestid unset, as the options are empty by default and unaffected in that state.
Place Fabio behind an edge proxy that sanitizes or removes attacker-controlled Connection headers before they reach Fabio.
Enforce backend authorization using mutual TLS or signed tokens rather than trusting proxy-injected headers alone.

bash

# Upgrade Fabio to the patched release
wget https://github.com/fabiolb/fabio/releases/download/v1.7.2/fabio-1.7.2-linux_amd64
chmod +x fabio-1.7.2-linux_amd64
mv fabio-1.7.2-linux_amd64 /usr/local/bin/fabio
fabio -v