CVE-2026-39858
traefik: Traefik: Authentication bypass via unsanitized alias headers
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (hoch).
Beschreibung
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/traefik/traefik, github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 | 2.11.43 und 1 weitere |
| minimos | traefik-3, traefik-fips-3 | 3.6.14-r0 |
| rapidfort alpine 3.20 | traefik | 3.7.0-r0 |
| rapidfort alpine 3.21 | traefik | 3.7.0-r0 |
| rapidfort alpine 3.22 | traefik | 3.7.0-r0 |
| rapidfort alpine 3.23 | traefik | 3.7.0-r0 |
Alle 9 Einträge aus 6 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/traefik/traefik | kein Fix angegeben |
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v2 | 2.11.43 |
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v3 | 3.7.0-rc.2, 3.6.14 |
| minimos | traefik-3 | 3.6.14-r0 |
| minimos | traefik-fips-3 | 3.6.14-r0 |
| rapidfort alpine 3.20 | traefik | 3.7.0-r0 |
| rapidfort alpine 3.21 | traefik | 3.7.0-r0 |
| rapidfort alpine 3.22 | traefik | 3.7.0-r0 |
| rapidfort alpine 3.23 | traefik | 3.7.0-r0 |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/security/cve/CVE-2026-39858
- https://bugzilla.redhat.com/show_bug.cgi?id=2464234
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/releases/tag/v2.11.43
- https://github.com/traefik/traefik/releases/tag/v3.6.14
- https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2
- https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm