CVE-2026-88011

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88011", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-09T19:19:27.407Z", "datePublished": "2026-09-10T15:31:55.215Z", "dateUpdated": "2026-09-15T14:42:22.088Z"}, "containers": {"cna": {"title": "Traefik: ForwardAuth identity spoofing via dot-form header alias", "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c"}, {"name": "https://github.com/traefik/traefik/pull/13720", "tags": ["x_refsource_MISC"], "url": "https://github.com/traefik/traefik/pull/13720"}, {"name": "https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8", "tags": ["x_refsource_MISC"], "url": "https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8"}, {"name": "https://github.com/traefik/traefik/releases/tag/v2.11.56", "tags": ["x_refsource_MISC"], "url": "https://github.com/traefik/traefik/releases/tag/v2.11.56"}, {"name": "https://github.com/traefik/traefik/releases/tag/v3.7.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/traefik/traefik/releases/tag/v3.7.12"}], "affected": [{"vendor": "traefik", "product": "traefik", "versions": [{"version": "< 2.11.56", "status": "affected"}, {"version": ">= 3.0.0, < 3.7.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-10T15:31:55.215Z"}, "descriptions": [{"lang": "en", "value": "Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12."}], "source": {"advisory": "GHSA-rf44-j88r-hh8c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T14:42:09.176083Z", "id": "CVE-2026-88011", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T14:42:22.088Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-88011", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-15T14:42:09.176083Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T14:42:15.765Z"}}], "cna": {"title": "Traefik: ForwardAuth identity spoofing via dot-form header alias", "source": {"advisory": "GHSA-rf44-j88r-hh8c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "traefik", "product": "traefik", "versions": [{"status": "affected", "version": "< 2.11.56"}, {"status": "affected", "version": ">= 3.0.0, < 3.7.12"}]}], "references": [{"url": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c", "name": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/traefik/traefik/pull/13720", "name": "https://github.com/traefik/traefik/pull/13720", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8", "name": "https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/traefik/traefik/releases/tag/v2.11.56", "name": "https://github.com/traefik/traefik/releases/tag/v2.11.56", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/traefik/traefik/releases/tag/v3.7.12", "name": "https://github.com/traefik/traefik/releases/tag/v3.7.12", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-10T15:31:55.215Z"}}}, "cveMetadata": {"cveId": "CVE-2026-88011", "state": "PUBLISHED", "dateUpdated": "2026-09-15T14:42:22.088Z", "dateReserved": "2026-09-09T19:19:27.407Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-10T15:31:55.215Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "traefik", "vendor": "traefik", "versions": [{"status": "affected", "version": "< 2.11.56"}, {"status": "affected", "version": ">= 3.0.0, < 3.7.12"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF2BF7E5-86D5-4141-AD3F-3189F996CCC8", "versionEndExcluding": "2.11.56", "vulnerable": true}, {"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA63A7E8-A5BB-4456-965E-F493CCC6D3C5", "versionEndExcluding": "3.7.12", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12."}], "id": "CVE-2026-88011", "lastModified": "2026-09-15T15:17:24.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88011", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-15T14:42:09.176083Z", "version": "2.0.3"}}]}, "published": "2026-09-10T16:18:07.933", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/traefik/traefik/pull/13720"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/traefik/traefik/releases/tag/v2.11.56"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/traefik/traefik/releases/tag/v3.7.12"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/traefik/traefik: Traefik: Identity spoofing via dot-form header alias", "id": "2531524", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531524"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.", "A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. A remote attacker can exploit this vulnerability by sending a specially crafted dot-form header, such as X.Authenticated.User. Due to a discrepancy in how Go and certain backend systems (like CGI, WSGI, PHP, and NGINX) interpret these headers, the backend may consume the client's supplied value instead of the identity asserted by Traefik. This allows for identity spoofing for any header managed by Traefik, potentially leading to unauthorized access or actions."], "mitigation": {"lang": "en:us", "value": "Update Traefik to 2.11.56 or 3.7.12 (or later) and explicitly configure entrypoints with 'aliasHeadersStrategy: delete' or 'aliasHeadersStrategy: reject', as the feature defaults to 'keep' for backward compatibility."}, "name": "CVE-2026-88011", "package_state": [{"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-09-10T15:31:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88011\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88011\nhttps://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8\nhttps://github.com/traefik/traefik/pull/13720\nhttps://github.com/traefik/traefik/releases/tag/v2.11.56\nhttps://github.com/traefik/traefik/releases/tag/v3.7.12\nhttps://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c"], "statement": "A flaw in Traefik allows remote attackers to spoof identity and authorization headers passed to backend services. Traefik canonicalizes headers containing dashes but ignores dot-form aliases (e.g., X.Authenticated.User), allowing them to bypass ForwardAuth replacement middleware. When requests reach normalization-prone backends (such as CGI, WSGI, PHP, or NGINX), these platforms collapse dot-form aliases and canonical headers into identical environment variables, causing the backend to consume the attacker-controlled value instead of Traefik's asserted identity.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.7.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traefik", "source": "cna", "vendor": "traefik"}, "product": "traefik", "vendor": "traefik"}], "created": "2026-09-10T16:30:17.270582+00:00", "updated": "2026-09-23T02:30:17.687382+00:00", "vendors": ["traefik", "traefik$PRODUCT$traefik"]}