CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:NCVE-2026-54764
Medium (6.9) in traefik traefik. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/traefik/traefik/v2 2.11.51.
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
Severity
CVSS 3.1
5.8 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
- CWE
- CWE-345
- Published
- Modified
- Record from
- the NVD, synced
Affected
- traefik:traefik
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3q9r-p662-5j8m | Go | github.com/traefik/traefik/v2 | <2.11.51 | 2.11.51 |
| GHSA-3q9r-p662-5j8m | Go | github.com/traefik/traefik/v3 | <3.6.22 | 3.6.22 |
| GHSA-3q9r-p662-5j8m | Go | github.com/traefik/traefik/v3 | >=3.7.0 <3.7.6 | 3.7.6 |
| GHSA-3q9r-p662-5j8m | Go | github.com/traefik/traefik | <=1.7.34 | no fix published |
| GO-2026-6202 | Go | github.com/traefik/traefik | all versions | no fix published |
| GO-2026-6202 | Go | github.com/traefik/traefik/v2 | <2.11.51 | 2.11.51 |
| GO-2026-6202 | Go | github.com/traefik/traefik/v3 | <3.6.22 >=3.7.0 <3.7.6 | 3.6.22, 3.7.6 |