Traefik: ForwardAuth identity spoofing via dot-form header alias

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-88011 · Microsoft / collected KEV context

CVE-2026-88879 · Microsoft / collected KEV context

EUVD-2026-75429

GHSA-cwr6-3wm2-9xhw

EUVD-2026-75584

GHSA-rf44-j88r-hh8c

GO-2026-6455

cve-program · CVE-2026-88011

• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://github.com/traefik/traefik/pull/13720
• https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8
• https://github.com/traefik/traefik/releases/tag/v2.11.56
• https://github.com/traefik/traefik/releases/tag/v3.7.12

cve-program · CVE-2026-88879

• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://www.vulncheck.com/advisories/traefik-before-2.11.56-identity-spoofing-via-header-alias

euvd · EUVD-2026-75429

• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://www.vulncheck.com/advisories/traefik-before-2.11.56-identity-spoofing-via-header-alias

euvd · EUVD-2026-75584

• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://github.com/traefik/traefik/pull/13720
• https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8
• https://github.com/traefik/traefik/releases/tag/v2.11.56
• https://github.com/traefik/traefik/releases/tag/v3.7.12

nvd · CVE-2026-88011

• https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8
• https://github.com/traefik/traefik/pull/13720
• https://github.com/traefik/traefik/releases/tag/v2.11.56
• https://github.com/traefik/traefik/releases/tag/v3.7.12
• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c

nvd · CVE-2026-88879

• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://www.vulncheck.com/advisories/traefik-before-2.11.56-identity-spoofing-via-header-alias

osv · GHSA-rf44-j88r-hh8c

• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://nvd.nist.gov/vuln/detail/CVE-2026-88011
• https://github.com/traefik/traefik/pull/13720
• https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v2.11.56
• https://github.com/traefik/traefik/releases/tag/v3.7.12

osv · GO-2026-6455

• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://nvd.nist.gov/vuln/detail/CVE-2026-88011
• https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8
• https://github.com/traefik/traefik/pull/13720
• https://github.com/traefik/traefik/releases/tag/v2.11.56
• https://github.com/traefik/traefik/releases/tag/v3.7.12

• Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct… · Advisory content revised · 1 Nov 2026
• Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy bec… · Advisory content revised · 1 Nov 2026