CVE-2026-88879

Traefik (HTTP reverse proxy and load balancer) in v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11 canonicalizes header names only on dashes, so X-Auth-User, X_Auth_User, and X.Auth.User are treated as three distinct headers by Traefik. However, backends (CGI, WSGI, PHP, NGINX) collapse th...