Authentication Bypass Vulnerability in Traefik HTTP Reverse Proxy and Load Balancer
CVE-2026-39858
What is CVE-2026-39858?
Traefik, a popular HTTP reverse proxy and load balancer, suffers from an authentication bypass vulnerability due to flawed header sanitization logic in its ForwardAuth and snippet-based authentication middleware. The vulnerability arises when Traefik processes headers with underscore variants (e.g., X_Forwarded_Proto) without proper normalization, allowing attackers to manipulate these headers and potentially spoof trusted contexts. This oversight enables bypassing authentication and gaining unauthorized access to protected routes, making it crucial for users to upgrade to the patched versions (2.11.43, 3.6.14, 3.7.0-rc.2) to mitigate these risks.
Affected Version(s)
traefik < 2.11.43 < 2.11.43
traefik >= 3.0.0-beta1, < 3.6.14 < 3.0.0-beta1, 3.6.14
traefik >= 3.7.0-ea.1, < 3.7.0-rc.2 < 3.7.0-ea.1, 3.7.0-rc.2