{"uuid": "8e32f2ec-4847-42e4-9874-453c98eb1043", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-x677-9fxg-v5c5", "type": "seen", "source": "https://gist.github.com/alon710/b0c30693be99e5683b1b7fa34bf1c9d1", "content": "# CVE-2026-54763: CVE-2026-54763: Authentication Bypass and Identity Spoofing in Traefik Middlewares via Header Normalization Discrepancies\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54763\n\n## Summary\nA critical authentication bypass and context spoofing vulnerability exists in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares prior to versions 2.11.51, 3.6.22, and 3.7.6. The flaw arises because Traefik's header cleanup mechanisms rely on Go's standard library header canonicalization, which does not modify or delete headers containing underscores. Consequently, unauthenticated remote attackers can inject custom underscore-variant headers (e.g., X_Auth_User) that bypass Traefik's stripping filters and reach backend application servers. When downstream backends normalize both hyphens and underscores into the same environment variables, the attacker's spoofed identity value is processed as trusted authorization data.\n\n## TL;DR\nTraefik's authentication middlewares fail to strip client-supplied headers containing underscores, permitting remote unauthenticated attackers to bypass identity controls and spoof authenticated metadata on backend systems that normalize hyphens and underscores identically.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-178, CWE-290, CWE-345\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 10.0 (Critical)\n- **EPSS Score**: 0.002 (Percentile: 9.96%)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Traefik Proxy (BasicAuth, DigestAuth, ForwardAuth middlewares)\n- Python WSGI/ASGI application servers (Gunicorn, uWSGI)\n- PHP-FPM and CGI-based application containers\n- Ruby Rack and thin-server deployment environments\n- **Traefik**: < 2.11.51 (Fixed in: `2.11.51`)\n- **Traefik**: >= 3.0.0-beta1, < 3.6.22 (Fixed in: `3.6.22`)\n- **Traefik**: >= 3.7.0-ea.1, < 3.7.6 (Fixed in: `3.7.6`)\n\n## Mitigation\n\n- Upgrade Traefik instances to 2.11.51, 3.6.22, or 3.7.6.\n- Explicitly configure the entrypoint `underscoreHeadersStrategy` to 'delete' or 'reject' in the configuration.\n- Deploy Web Application Firewall (WAF) rules to inspect and block client-supplied HTTP headers containing underscores.\n- Implement cryptographically signed identity assertions (such as JWTs) between Traefik and internal backend servers.\n\n**Remediation Steps:**\n1. Identify all entrypoint definitions within the Traefik dynamic/static configuration files (toml, yaml, or CLI flags).\n2. Add the configuration parameter `underscoreHeadersStrategy: delete` to all active HTTP entrypoints.\n3. Restart the Traefik service and verify that requests carrying underscore-variant headers are sanitized before reaching backend systems.\n4. Audit downstream backend frameworks to ensure they do not accept unauthenticated environment variables for identity evaluation.\n\n## References\n\n- [NVD - CVE-2026-54763 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-54763)\n- [GitHub Security Advisory GHSA-x677-9fxg-v5c5](https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54763) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T17:31:27.831992Z"}