MEDIUM 5.8 GitHub
CVE-2026-54764
Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
## Summary
There is a medium severity vulnerability in Traefik's ForwardAuth middleware. Even when configured with `trustForwardHeader: false`, Traefik derives the `X-Forwarded-Port` header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an `X-Forwarded-Proto: https` header over a plain HTTP connection and cause Traefik to forward `X-Forwarded-Port: 443` to the auth servi
Affected Products
- go/github.com/traefik/traefik/v2 <= 2.11.50
- go/github.com/traefik/traefik/v3 <= 3.6.21
- go/github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.5
- go/github.com/traefik/traefik <= 1.7.34
References
- https://github.com/advisories/GHSA-3q9r-p662-5j8m
- https://github.com/traefik/traefik/security/advisories/GHSA-3q9r-p662-5j8m
- https://nvd.nist.gov/vuln/detail/CVE-2026-54764
- https://github.com/traefik/traefik/pull/13344
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-08-06 via GitHub. Affected: go/github.com/traefik/traefik/v2 <= 2.11.50, go/github.com/traefik/traefik/v3 <= 3.6.21, go/github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.5 and 1 more.
vulnfeed aggregates 9207 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.