CVE-2026-88879: Traefik before v2.11.56 Identity Spoofing via Header Alias
Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX and others) collapse them into a single variable. A client can therefore smuggle a dot-form alias of a header that Traefik manages past the middleware managing it — for example supplying X.Authenticated.User alongside the canonical X-Authenticated-User written by the ForwardAuth middleware — causing such a backend to read the client-supplied value instead of the identity Traefik asserted. In the tested configuration (PHP 8.2 built-in SAPI over an HTTP/1 backend path), Go's lexical header ordering makes the attacker-supplied value win deterministically, so a client that ForwardAuth admits as a low-privilege identity can be treated by the backend as a different user or role. Any header Traefik sets is affected, not only ForwardAuth's. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which blocked only the underscore form. Fixed in v2.11.56 and v3.7.12, which add the aliasHeadersStrategy entry-point option; because it defaults to 'keep' for backwards compatibility, it must be explicitly set to 'delete' or 'reject' for the fix to take effect. Unmaintained release lines will not receive a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 2.11.56 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.7.12 - Configuration
Set Traefik entry-point option aliasHeadersStrategy to 'delete' so that the v2.11.56/v3.7.12 fix takes effect (defaults to 'keep' for backwards compatibility).
Traefik aliasHeadersStrategy = delete - Compensating control
If upgrading is not possible for an unmaintained release line, explicitly set aliasHeadersStrategy to 'delete' or 'reject' on the relevant Traefik entry-point (note: the fix mechanism requires this option to be set, since it defaults to 'keep').
Event History
Frequently Asked Questions
Which deployments are exposed to identity spoofing?
Exposure requires a backend that converts differently punctuated HTTP header names into the same variable, such as CGI, WSGI, PHP, or NGINX-based handling. The risk applies when that backend relies on headers set or managed by Traefik for identity, roles, or other security-relevant values.
What does an attacker need to exploit this?
The attacker must be able to send requests through Traefik and provide a dot-form alias of a header Traefik manages, such as X.Authenticated.User alongside X-Authenticated-User. In the demonstrated case, a user admitted by ForwardAuth as a low-privilege identity could cause the backend to use an attacker-supplied identity or role value.
How can I determine whether my instance is affected?
Affected releases include Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11. Review whether downstream applications normalize header punctuation into a shared variable name and consume Traefik-provided headers for authorization or identity decisions.
Is ForwardAuth the only affected feature?
No. ForwardAuth is the example given, but any header set by Traefik can be affected if a downstream backend collapses the canonical header name and its dot-form alias into the same variable.