Unauthenticated Header Bypasses in Traefik Reverse Proxy by Traefik Labs
CVE-2026-88004
What is CVE-2026-88004?
Traefik, an open-source HTTP reverse proxy and load balancer, has a vulnerability affecting versions 3.2.0 through 3.7.13. The entrypoint defenses, namely aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders, inadequately inspect req.Header without evaluating req.Trailer. This flaw enables unauthenticated attackers to exploit aliasing or trusted header names via an HTTP/1.1 chunked trailer or HTTP/2 trailer. Consequently, when the retry or buffering middleware processes the body before the request is cloned, malicious trailer values can be sent to the backend, where they can merge with headers. This behavior circumvents expected security measures to block or reject dubious headers, potentially leading to identity spoofing or altered routing data. The vulnerability was addressed in version 3.7.13.
Affected Version(s)
traefik >= 3.2.0, < 3.7.13