GO-2026-6202

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false in github.com/traefik/traefik

At a glance

Published: 2026-08-18 14:32 UTC
Updated: 2026-08-18 15:00 UTC
CVE: CVE-2026-54764
Aliases: GHSA-3q9r-p662-5j8m

Description

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false in github.com/traefik/traefik

Affected packages

Package	Versions
Go · github.com/traefik/traefik	introduced 0
Go · github.com/traefik/traefik/v2	introduced 0, fixed 2.11.51
Go · github.com/traefik/traefik/v3	introduced 0, fixed 3.6.22, introduced 3.7.0, fixed 3.7.6

References

https://github.com/traefik/traefik/security/advisories/GHSA-3q9r-p662-5j8m ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-54764 ADVISORY
https://github.com/traefik/traefik/commit/7ae92d8c2c10ac04ef5a03df0ed5019ce0f44b2d FIX
https://github.com/traefik/traefik/pull/13344 FIX
https://github.com/traefik/traefik/releases/tag/v2.11.51 WEB
https://github.com/traefik/traefik/releases/tag/v3.6.22 WEB
https://github.com/traefik/traefik/releases/tag/v3.7.6 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database