CVE-2026-54763: CVE-2026-54763: Authentication Bypass and Identity Spoofing in Traefik Middlewares via Header Normalization Discrepancies

CVE-2026-54763: Authentication Bypass and Identity Spoofing in Traefik Middlewares via Header Normalization Discrepancies

Vulnerability ID: CVE-2026-54763
CVSS Score: 10.0
Published: 2026-08-06

A critical authentication bypass and context spoofing vulnerability exists in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares prior to versions 2.11.51, 3.6.22, and 3.7.6. The flaw arises because Traefik's header cleanup mechanisms rely on Go's standard library header canonicalization, which does not modify or delete headers containing underscores. Consequently, unauthenticated remote attackers can inject custom underscore-variant headers (e.g., X_Auth_User) that bypass Traefik's stripping filters and reach backend application servers. When downstream backends normalize both hyphens and underscores into the same environment variables, the attacker's spoofed identity value is processed as trusted authorization data.

TL;DR

Traefik's authentication middlewares fail to strip client-supplied headers containing underscores, permitting remote unauthenticated attackers to bypass identity controls and spoof authenticated metadata on backend systems that normalize hyphens and underscores identically.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-178, CWE-290, CWE-345
• Attack Vector: Network (Unauthenticated)
• CVSS v3.1 Score: 10.0 (Critical)
• EPSS Score: 0.002 (Percentile: 9.96%)
• Exploit Status: Proof-of-Concept Available
• CISA KEV Status: Not Listed

Affected Systems

• Traefik Proxy (BasicAuth, DigestAuth, ForwardAuth middlewares)
• Python WSGI/ASGI application servers (Gunicorn, uWSGI)
• PHP-FPM and CGI-based application containers
• Ruby Rack and thin-server deployment environments
• Traefik: < 2.11.51 (Fixed in: 2.11.51)
• Traefik: >= 3.0.0-beta1, < 3.6.22 (Fixed in: 3.6.22)
• Traefik: >= 3.7.0-ea.1, < 3.7.6 (Fixed in: 3.7.6)

Exploit Details

• GitHub Security Advisory Integration Tests: Integration tests within the official advisory illustrate programmatically generating underscore-variant header injection to bypass authentication boundaries.

Mitigation Strategies

• Upgrade Traefik instances to 2.11.51, 3.6.22, or 3.7.6.
• Explicitly configure the entrypoint underscoreHeadersStrategy to 'delete' or 'reject' in the configuration.
• Deploy Web Application Firewall (WAF) rules to inspect and block client-supplied HTTP headers containing underscores.
• Implement cryptographically signed identity assertions (such as JWTs) between Traefik and internal backend servers.

Remediation Steps:

1. Identify all entrypoint definitions within the Traefik dynamic/static configuration files (toml, yaml, or CLI flags).
2. Add the configuration parameter underscoreHeadersStrategy: delete to all active HTTP entrypoints.
3. Restart the Traefik service and verify that requests carrying underscore-variant headers are sanitized before reaching backend systems.
4. Audit downstream backend frameworks to ensure they do not accept unauthenticated environment variables for identity evaluation.

References

• NVD - CVE-2026-54763 Detail
• GitHub Security Advisory GHSA-x677-9fxg-v5c5

---

Read the full report for CVE-2026-54763 on our website for more details including interactive diagrams and full exploit analysis.

Comments

[Luis Cruz]

The issue with Traefik's header cleanup mechanisms relying on Go's standard library header canonicalization is particularly concerning, as it allows attackers to inject custom underscore-variant headers that can bypass authentication controls. I've seen similar issues in other frameworks where header normalization discrepancies can lead to security vulnerabilities. The recommended mitigation strategy of configuring the underscoreHeadersStrategy to 'delete' or 'reject' is a good temporary fix, but I'm curious to know if there are any plans to improve Traefik's header normalization mechanisms to handle such edge cases more robustly.