CVE-2026-33433CWE-290

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Medium · published March 27, 2026

CVSS v4.0
5.1
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00565 · 46.2th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-03-27T13:49Z
EPSS history
Timeline
  • 27 MAR 13:49Z
    Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
    cvelistv5