CVE-2026-54763

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.51 Traefik versions prior to 3.6.22 Traefik versions prior to 3.7.6

Description Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares fail to account for underscore-variant header names when stripping spoofed identity headers. While canonical-cased headers are removed before Traefik writes its own values, underscore variants may be ignored. Because many backends normalize underscore-variant headers identically to dashed forms, an attacker can inject such headers to bypass stripping. This allows the injection of unauthorized identity or authorization context that reaches the backend, potentially via the authResponseHeaders path in ForwardAuth.

Recommendations Update to version 2.11.51. Update to version 3.6.22. Update to version 3.7.6.