CVE-2026-54764: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in v2.11.51 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in v3.6.22 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in v3.7.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54764?
The severity of CVE-2026-54764 is rated at 62.
How do I fix CVE-2026-54764?
To fix CVE-2026-54764, upgrade Traefik to versions v2.11.51, v3.6.22, or v3.7.6 or higher.
What vulnerability does CVE-2026-54764 expose in Traefik's ForwardAuth middleware?
CVE-2026-54764 exposes a spoofing risk due to the leakage of the X-Forwarded-Port header when trustForwardHeader is set to false.
Which versions of Traefik are affected by CVE-2026-54764?
CVE-2026-54764 affects Traefik versions prior to v2.11.51, v3.6.22, and v3.7.6.
What is the primary risk associated with CVE-2026-54764?
The primary risk associated with CVE-2026-54764 is the potential for untrusted sources to manipulate the X-Forwarded-Port header.