Bug 1270430 (CVE-2026-54763) - VUL-0: CVE-2026-54763: TRACKERBUG: traefik2,traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
Summary: VUL-0: CVE-2026-54763: TRACKERBUG: traefik2,traefik: headerField underscore-v...
Status: RESOLVED UPSTREAM
Alias: CVE-2026-54763
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/532248/
Whiteboard: CVSSv3.1:SUSE:CVE-2026-54763:7.5:(AV:...
Keywords:
Depends on: 1270431
Blocks:
  Show dependency tree / graph
 
Reported: 2026-07-07 08:06 UTC by Emanuele Cappello
Modified: 2026-07-10 09:52 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Emanuele Cappello 2026-07-07 08:06:54 UTC 
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-54763
https://www.cve.org/CVERecord?id=CVE-2026-54763
https://github.com/traefik/traefik/commit/108a5264473a2cbc8f12d6d691a3c6553cdf2c1b
https://github.com/traefik/traefik/pull/13262
https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5
Comment 1 Johannes Weberhofer 2026-07-10 09:52:32 UTC 
Resolved with version 2.11.51 and 3.7.6