CVE-2026-88879

Name of the Vulnerable Software and Affected Versions Traefik versions 1.x Traefik versions 2.x through 2.11.55 Traefik versions 3.0.0 through 3.7.11

Description Traefik handles request header canonicalization only on dashes, meaning it treats headers like X-Auth-User, X Auth User, and X.Auth.User as distinct. However, certain backends such as CGI, WSGI, PHP, and NGINX collapse these variations into a single variable. This allows a client to smuggle a dot-form alias of a header past the middleware. For example, by providing X.Authenticated.User alongside the canonical X-Authenticated-User generated by the ForwardAuth middleware, a backend may prioritize the client-supplied value over the identity asserted by Traefik. This can lead to identity spoofing, where a low-privilege user is treated as a different user or administrative role. This issue affects any header set by Traefik.

Recommendations For Traefik versions 2.x through 2.11.55, upgrade to version 2.11.56 and explicitly set the aliasHeadersStrategy entry-point option to delete or reject. For Traefik versions 3.0.0 through 3.7.11, upgrade to version 3.7.12 and explicitly set the aliasHeadersStrategy entry-point option to delete or reject. For Traefik versions 1.x, upgrade to version 2.11.56 or 3.7.12 and explicitly set the aliasHeadersStrategy entry-point option to delete or reject.