Velgusgus599

Traefik handles request header canonicalization only on dashes, meaning it treats headers like `X-Auth-User`, `X Auth User`, and `X.Auth.User` as distinct. However, certain backends such as CGI, WSGI, PHP, and NGINX collapse these variations into a single variable. This allows a client to smuggle a dot-form alias of a header past the middleware. For example, by providing `X.Authenticated.User` alongside the canonical `X-Authenticated-User` generated by the ForwardAuth middleware, a backend may prioritize the client-supplied value over the identity asserted by Traefik. This can lead to identity spoofing, where a low-privilege user is treated as a different user or administrative role. This issue affects any header set by Traefik.

An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named `value` at the root, the software replaces the entire request body with the value of that property before the handler executes. This results in the handler receiving an object different from the one that satisfied the schema. An authenticated low-privilege caller can exploit this to replace the validated body with nested data, potentially triggering unauthorized operations, leading to unauthorized state changes and data disclosure.

The Kubernetes Ingress provider fails to enforce crossProviderNamespaces restrictions regarding the `traefik.ingress.kubernetes.io/service.middlewares` Service annotation. This allows a namespace-limited tenant that is not on the allowlist to attach a middleware owned by an operator to its Service. If the middleware is configured to inject backend credentials, the tenant can recover those credentials at a backend they control.

A schema validation bypass occurs when a request body schema targets a root primitive value. When validating a top-level primitive, such as an integer, Ajv (a JSON schema validator) may coerce a JSON string into the expected type. However, the framework fails to replace the root request body with this coerced value, causing the route handler to receive the original unvalidated string. This allows requests that should have failed validation to reach application logic with values that do not satisfy the schema, potentially undermining integrity and access-control checks that rely on the validated type.