CVE-2026-54764: Traefik ForwardAuth Header Injection Authorization Bypass

Technical summary

CVE-2026-54764 is a header injection vulnerability in Traefik's ForwardAuth middleware affecting versions prior to v2.11.51, v3.6.22, and v3.7.6. The flaw stems from improper header sanitization in the authentication forwarding logic. When trustForwardHeader is set to false (intended to reject untrusted X-Forwarded-* headers from upstream proxies), the middleware still derives X-Forwarded-Port from the original request headers rather than from the actual TLS/TCP context. An attacker can inject X-Forwarded-Proto: https over a plain HTTP connection; Traefik then forwards X-Forwarded-Port: 443 to the backend authentication service. This allows circumvention of port-based access control policies that depend on the auth service receiving the correct port number. The vulnerability is classified as an Insecure Deserialization variant (CWE-345) due to the trust placed in unvalidated forwarded headers.

Business impact

For organizations using Traefik with port-based or protocol-aware authentication rules, this vulnerability enables unauthorized access to protected services. If an authentication service relies on X-Forwarded-Port to enforce policies (e.g., 'allow HTTPS but block HTTP'), an attacker can forge the header and bypass those controls. Exposure depends on how strictly port-based authorization is enforced downstream; services that do not validate port-level policies are not affected. The impact is particularly significant for multi-tenant environments, API gateways, and microservices deployments where Traefik acts as the primary ingress controller.

Affected systems

Traefik versions prior to v2.11.51 (v2.x branch), v3.6.22 (v3.6.x branch), and v3.7.6 (v3.7.x branch) are vulnerable. All deployments running unpatched versions with ForwardAuth middleware enabled are at risk, regardless of the trustForwardHeader setting. The vulnerability does not require specific network configuration or authentication backend type; it affects any setup where Traefik forwards headers to an authentication service that validates port-level access.

Exploitability

The attack is trivial to execute and requires no authentication. An unauthenticated remote attacker can craft a single malicious HTTP request with a spoofed X-Forwarded-Proto header, no special privileges or access to internal systems. The vulnerability is not currently tracked in the CISA KEV catalog, suggesting limited evidence of active exploitation at the time of publication, though the ease of exploitation and visibility of Traefik in cloud-native architectures present a meaningful risk. The CVSS 3.1 score of 5.8 (MEDIUM) reflects the network-accessible attack vector, low complexity, and integrity impact, tempered by the requirement for a specific authentication configuration and the lack of confidentiality or availability impact.

Remediation

Upgrade to Traefik v2.11.51, v3.6.22, or v3.7.6 or later, depending on which branch you operate. Verify the patched version against the vendor advisory before deployment. Temporary mitigations prior to patching include: (1) Disabling ForwardAuth if port-based access controls are not required, (2) Configuring upstream reverse proxies or WAF rules to strip or validate X-Forwarded-Proto headers before they reach Traefik, and (3) Implementing port-validation logic in your authentication service to reject mismatches between the claimed X-Forwarded-Port and the actual connection port.

Patch guidance

Apply updates in the following order by version branch: v2.11.51 or later for the v2.x line, v3.6.22 or later for v3.6.x, and v3.7.6 or later for v3.7.x. Test in a staging environment before deploying to production to ensure ForwardAuth behavior remains consistent. Monitor authentication logs post-patch for any anomalies. If you are on a legacy v2.x version, consider planning a roadmap to v3.x in the medium term for long-term support and security updates.

Detection guidance

Monitor Traefik logs for X-Forwarded-Proto: https headers arriving over non-TLS connections. Correlate authentication service logs with Traefik forwarding logs to detect cases where X-Forwarded-Port does not match the actual connection port. Implement intrusion detection rules to flag HTTP requests containing X-Forwarded-Proto: https with high confidence. Review recent authentication logs for anomalous port values (e.g., port 443 claims on HTTP connections) that may indicate successful exploitation attempts.

Why prioritize this

Although the CVSS score is MEDIUM (5.8), the ease of exploitation and the widespread use of Traefik in modern cloud-native and Kubernetes deployments warrant rapid patching. The vulnerability is not (as of publication) in active exploitation, providing a window to update before threat actors systematize attacks. Organizations relying on port-based authorization should treat this as HIGH priority; others with port-agnostic auth rules may deprioritize but should still patch within standard maintenance cycles.

Risk score, explained

The CVSS 3.1 score of 5.8 reflects a network-accessible attack (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). Integrity is slightly impacted (I:L) because unauthorized access modifies the security decision. Scope is changed (S:C) because the attack affects the confidentiality model of the authentication service. The score does not escalate to HIGH due to lack of direct confidentiality or availability impact on Traefik itself; however, downstream access control bypass (the true impact) is significant in many real-world deployments.

Frequently asked questions