CVE-2026-88011

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. A remote attacker can exploit this vulnerability by sending a specially crafted dot-form header, such as X.Authenticated.User. Due to a discrepancy in how Go and certain backend systems like CGI, WSGI, PHP, and NGIN...

SUSE CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

GO-2026-6455 Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik

Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik...

Traefik: ForwardAuth identity spoofing via dot-form header alias

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...

GHSA-RF44-J88R-HH8C Traefik: ForwardAuth identity spoofing via dot-form header alias

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...

CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

CVE-2026-88011 Traefik: ForwardAuth identity spoofing via dot-form header alias

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

EUVD-2026-75584

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

CVE-2026-88011 Traefik: ForwardAuth identity spoofing via dot-form header alias

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

CVE-2026-88011

Traefik 's ForwardAuth middleware is vulnerable to identity spoofing via dot-form header aliases (e.g. X.Authenticated.User). Go treats these as distinct from the canonical dash-form header, but backends such as PHP, CGI, WSGI, and NGINX collapse both into the same variable, allowing a permitted ...

CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

CVE-2026-88011 Traefik: ForwardAuth identity spoofing via dot-form header alias

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

CVE-2026-88879

Traefik (HTTP reverse proxy and load balancer) is vulnerable to identity spoofing via dot-form header aliasing in versions v1.x, v2.x–v2.11.55, and v3.0.0–v3.7.11. Because Go canonicalizes header names on dashes only, a client can send a dot-form alias (e.g., X.Authenticated.User) alongside the c...

CVE-2026-88879 Traefik before v2.11.56 Identity Spoofing via Header Alias

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, XAuthUser and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable...

PT-2026-89472

Name of the Vulnerable Software and Affected Versions Traefik versions 1.x Traefik versions prior to 2.11.56 Traefik versions 3.0.0 through 3.7.11 Description Traefik fails to properly handle request headers that act as aliases for other header names. While Go treats headers like...