CVE-2026-62987

Name of the Vulnerable Software and Affected Versions Fabio versions 1.6.6 through 1.7.1

Description An issue exists in the way the router handles HTTP headers. In the proxy/http headers.go file, the protectHeaders function uses a hardcoded set of forwarded headers but fails to include operator-configured ClientIPHeader, TLSHeader, and RequestID names. Additionally, in proxy/http proxy.go, the HTTPProxy.ServeHTTP() function calls addHeaders() to set trust headers before the Go ReverseProxy processes the inbound Connection header. This allows an unauthenticated client to specify and remove these configured headers before the request reaches the backend. Consequently, deployments with enabled proxy.header options may lose client-IP, TLS-termination, or request-correlation signals used for backend authorization and auditing.

Recommendations Update to version 1.7.2. Restrict the use of proxy.header options until the update is applied.