CVE-2026-54763

[CVE catalog]

Severity

Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Published

Jul 6, 2026, 8:33:36 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.24% · Oct 25, 2026

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. The BasicAuth, DigestAuth, and ForwardAuth middlewares in Traefik do not correctly treat underscore-variant header names. This allows a remote attacker to inject a specially crafted header that bypasses Traefik's security mechanisms. As a result, the attacker can spoof identity or authorization context to the backend, potentially gaining unauthorized access to protected resources. traefik: Traefik: Identity spoofing via improper header handling in authentication middlewares Important: This flaw in Traefik's authentication middlewares allows a remote attacker to bypass security mechanisms by injecting specially crafted underscore-variant headers. This can lead to identity spoofing or unauthorized access to backend services, as Traefik fails to properly strip these headers before forwarding them. The vulnerability is significant because many backend systems normalize these header forms, making exploitation feasible in typical deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.