CVE-2026-88879

Traefik is an HTTP reverse proxy and load balancer.

Traefik

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX and others) collapse them into a single variable. A client can therefore smuggle a dot-form alias of a header that Traefik manages past…

10. Sep 2026

Ausgewertete Quellen

• Hinweis
  https://www.vulncheck.com/advisories/traefik-before-2.11.56-identity-spoofing-via-header-alias
• NVD
  CVE-2026-88879
• GitHub
  https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c