CVE-2026-39858
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
30/04/2026
Last modified:
01/05/2026
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Impact
Base Score 4.0
7.80
Severity 4.0
HIGH
Base Score 3.x
10.00
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | 2.11.43 (excluding) | |
| cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | 3.0.0 (including) | 3.6.14 (excluding) |
| cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:* | ||
| cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:* | ||
| cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:* | ||
| cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page