CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer.

Traefik

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted…

10. Sep 2026

Ausgewertete Quellen

• NVD
  CVE-2026-88011
• GitHub
  https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c