Critical [CVE-2026-54763] Identity spoofing via improper header handling in authentication middlewares

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms.

An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context.

This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6. This allows a remote attacker to inject a specially crafted header that bypasses Traefik's security mechanisms.

As a result, the attacker can spoof identity or authorization context to the backend, potentially gaining unauthorized access to protected resources. This can lead to identity spoofing or unauthorized access to backend services, as Traefik fails to properly strip these headers before forwarding them.

The vulnerability is significant because many backend systems normalize these header forms, making exploitation feasible in typical deployments. Red Hat severity: Important — CVSS 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

Weakness: CWE-178.