CVE-2026-88879

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88879", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-10T11:24:26.196Z", "datePublished": "2026-09-10T13:05:30.872Z", "dateUpdated": "2026-10-08T15:25:59.454Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:25:59.454Z"}, "datePublic": "2026-08-27T00:00:00.000Z", "title": "Traefik before v2.11.56 Identity Spoofing via Header Alias", "descriptions": [{"lang": "en", "value": "Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX and others) collapse them into a single variable. A client can therefore smuggle a dot-form alias of a header that Traefik manages past the middleware managing it \u2014 for example supplying X.Authenticated.User alongside the canonical X-Authenticated-User written by the ForwardAuth middleware \u2014 causing such a backend to read the client-supplied value instead of the identity Traefik asserted. In the tested configuration (PHP 8.2 built-in SAPI over an HTTP/1 backend path), Go's lexical header ordering makes the attacker-supplied value win deterministically, so a client that ForwardAuth admits as a low-privilege identity can be treated by the backend as a different user or role. Any header Traefik sets is affected, not only ForwardAuth's. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which blocked only the underscore form. Fixed in v2.11.56 and v3.7.12, which add the aliasHeadersStrategy entry-point option; because it defaults to 'keep' for backwards compatibility, it must be explicitly set to 'delete' or 'reject' for the fix to take effect. Unmaintained release lines will not receive a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Authentication Bypass by Spoofing", "cweId": "CWE-290", "type": "CWE"}]}], "affected": [{"vendor": "traefik", "product": "traefik", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.11.56"}, {"version": "2.11.56", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "traefik", "product": "traefik", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "3.7.13"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.11.56"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0.0", "versionEndIncluding": "3.7.13"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-rf44-j88r-hh8c)"}, {"name": "VulnCheck Advisory: Traefik before v2.11.56 Identity Spoofing via Header Alias", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/traefik-before-2.11.56-identity-spoofing-via-header-alias"}], "credits": [{"lang": "en", "value": "velgusgus599", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T15:03:25.506535Z", "id": "CVE-2026-88879", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T15:04:00.316Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-88879", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T15:03:25.506535Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T15:03:41.162Z"}}], "cna": {"title": "Traefik before v2.11.56 Identity Spoofing via Header Alias", "credits": [{"lang": "en", "type": "reporter", "value": "velgusgus599"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "traefik", "product": "traefik", "versions": [{"status": "affected", "version": "0", "lessThan": "2.11.56", "versionType": "semver"}, {"status": "unaffected", "version": "2.11.56", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "defaultStatus": "unaffected"}, {"vendor": "traefik", "product": "traefik", "versions": [{"status": "affected", "version": "3.0.0", "versionType": "semver", "lessThanOrEqual": "3.7.13"}], "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "defaultStatus": "unaffected"}], "datePublic": "2026-08-27T00:00:00.000Z", "references": [{"url": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c", "name": "GitHub Security Advisory (GHSA-rf44-j88r-hh8c)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/traefik-before-2.11.56-identity-spoofing-via-header-alias", "name": "VulnCheck Advisory: Traefik before v2.11.56 Identity Spoofing via Header Alias", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX and others) collapse them into a single variable. A client can therefore smuggle a dot-form alias of a header that Traefik manages past the middleware managing it \u2014 for example supplying X.Authenticated.User alongside the canonical X-Authenticated-User written by the ForwardAuth middleware \u2014 causing such a backend to read the client-supplied value instead of the identity Traefik asserted. In the tested configuration (PHP 8.2 built-in SAPI over an HTTP/1 backend path), Go's lexical header ordering makes the attacker-supplied value win deterministically, so a client that ForwardAuth admits as a low-privilege identity can be treated by the backend as a different user or role. Any header Traefik sets is affected, not only ForwardAuth's. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which blocked only the underscore form. Fixed in v2.11.56 and v3.7.12, which add the aliasHeadersStrategy entry-point option; because it defaults to 'keep' for backwards compatibility, it must be explicitly set to 'delete' or 'reject' for the fix to take effect. Unmaintained release lines will not receive a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "Authentication Bypass by Spoofing"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.11.56"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "3.7.13", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:25:59.454Z"}}}, "cveMetadata": {"cveId": "CVE-2026-88879", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:25:59.454Z", "dateReserved": "2026-09-10T11:24:26.196Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-10T13:05:30.872Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "product": "traefik", "vendor": "traefik", "versions": [{"lessThan": "2.11.56", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.11.56", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "product": "traefik", "vendor": "traefik", "versions": [{"lessThanOrEqual": "3.7.13", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEC1DCAA-02FB-4FF2-B353-EEE832D5D594", "versionEndExcluding": "2.11.56", "versionStartIncluding": "1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA63A7E8-A5BB-4456-965E-F493CCC6D3C5", "versionEndExcluding": "3.7.12", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct headers by Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX and others) collapse them into a single variable. A client can therefore smuggle a dot-form alias of a header that Traefik manages past the middleware managing it \u2014 for example supplying X.Authenticated.User alongside the canonical X-Authenticated-User written by the ForwardAuth middleware \u2014 causing such a backend to read the client-supplied value instead of the identity Traefik asserted. In the tested configuration (PHP 8.2 built-in SAPI over an HTTP/1 backend path), Go's lexical header ordering makes the attacker-supplied value win deterministically, so a client that ForwardAuth admits as a low-privilege identity can be treated by the backend as a different user or role. Any header Traefik sets is affected, not only ForwardAuth's. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which blocked only the underscore form. Fixed in v2.11.56 and v3.7.12, which add the aliasHeadersStrategy entry-point option; because it defaults to 'keep' for backwards compatibility, it must be explicitly set to 'delete' or 'reject' for the fix to take effect. Unmaintained release lines will not receive a patch."}], "id": "CVE-2026-88879", "lastModified": "2026-10-08T16:17:58.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88879", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T15:03:25.506535Z", "version": "2.0.3"}}]}, "published": "2026-09-10T14:17:16.337", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/traefik-before-2.11.56-identity-spoofing-via-header-alias"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/traefik/traefik: Traefik: Identity spoofing via HTTP header alias", "id": "2531425", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531425"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["A flaw was found in Traefik, an HTTP reverse proxy and load balancer. Due to a discrepancy in how Traefik and certain backend applications process HTTP header names, a remote attacker can smuggle specially crafted headers. This allows the attacker to bypass identity assertions made by Traefik, leading to identity spoofing and potentially gaining unauthorized access or elevated privileges within the backend application."], "mitigation": {"lang": "en:us", "value": "Upgrade to fixed Traefik versions (v2.11.56, v3.7.12, or later) and explicitly configure the entrypoint option aliasHeadersStrategy to 'delete' or 'reject'. Alternatively, configure downstream backend web servers or WSGI/CGI gateways to strip or reject headers containing non-canonical characters before processing."}, "name": "CVE-2026-88879", "package_state": [{"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Not affected", "package_name": "openshift-gitops-1/argo-rollouts-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Not affected", "package_name": "openshift-gitops-1/argo-rollouts-rhel9", "product_name": "Red Hat OpenShift GitOps"}], "public_date": "2026-09-10T13:05:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88879\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88879\nhttps://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c\nhttps://www.vulncheck.com/advisories/traefik-before-2.11.56-identity-spoofing-via-header-alias"], "statement": "A flaw was found in Traefik's header canonicalization logic, where header names are canonicalized only on dashes. A remote authenticated client can supply dot-form header aliases (e.g., X.Auth.User alongside X-Auth-User) to bypass Traefik middleware assertions. When proxied to backends that collapse non-alphanumeric characters into singular variables (e.g., CGI, WSGI, PHP, NGINX), the backend resolves the attacker-controlled header value over Traefik's asserted identity. This leads to privilege escalation or identity spoofing within the downstream application context.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.11.56)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.11.56"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.7.13]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "traefik", "vendor": "traefik"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.11.56)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.11.56"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traefik", "source": "cna", "vendor": "traefik"}, "product": "traefik", "vendor": "traefik"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.7.13]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traefik", "source": "cna", "vendor": "traefik"}, "product": "traefik", "vendor": "traefik"}], "created": "2026-09-10T15:00:15.480866+00:00", "updated": "2026-09-21T05:45:10.213386+00:00", "vendors": ["traefik", "traefik$PRODUCT$traefik"]}