HIGH GitHub
CVE-2026-54763
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAu
## Summary
There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth
middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers
(e.g. `X-Auth-User`) before writing Traefik's own value, but did not account for
underscore-variant header names (e.g. `X_Auth_User`), which many backends normalize
identically to the dashed form. An attacker able to reach a protected route could inject
an underscore-variant header that survives Traefik's
Affected Products
- go/github.com/traefik/traefik/v2 <= 2.11.50
- go/github.com/traefik/traefik/v3 <= 3.6.21
- go/github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.5
References
- https://github.com/advisories/GHSA-x677-9fxg-v5c5
- https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5
- https://nvd.nist.gov/vuln/detail/CVE-2026-54763
- https://github.com/traefik/traefik/pull/13262
This high severity vulnerability was published on 2026-08-06 via GitHub. Affected: go/github.com/traefik/traefik/v2 <= 2.11.50, go/github.com/traefik/traefik/v3 <= 3.6.21, go/github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.5.
vulnfeed aggregates 9207 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.