Traefik Header Spoofing via Underscore-Variant Identity Headers (Auth Bypass)

Technical Analysis

The vulnerability (CVE-2026-54763) stems from Traefik's header-stripping logic only accounting for canonical dashed-case header names (e.g., X-Forwarded-User) while ignoring underscore-variant forms (e.g., X_Forwarded_User) that many backend frameworks and web servers normalize identically to the dashed form due to CGI/WSGI header canonicalization behavior. An attacker with network access to a protected route can craft requests with underscore-variant headers that survive Traefik's sanitization and reach the backend, either alongside or replacing the value Traefik intended to authoritatively set via ForwardAuth's authResponseHeaders. This allows full authentication and authorization bypass, letting attackers impersonate arbitrary users or escalate privileges on any service relying on Traefik for identity assertion. Many AI agent deployments use Traefik as an ingress/API gateway in front of agent orchestration services, RAG backends, or internal tool-calling APIs, and this flaw could let an attacker spoof authenticated identity headers to invoke privileged agent tools, access internal agent APIs, or bypass authorization checks that gate LLM function-calling endpoints.

Affected Systems

Traefik versions prior to v2.11.51, v3.6.22, and v3.7.6; specifically deployments using BasicAuth, DigestAuth, or ForwardAuth middlewares to enforce identity or authorization context on backend services; Kubernetes ingress controllers and API gateways running vulnerable Traefik versions

Indicators of Compromise

• No specific IOCs published; detection relies on identifying anomalous underscore-variant headers (e.g., X_Forwarded_User, X_Remote_User, X_Auth_Request_User) in backend request logs
• Monitor for requests containing both dashed and underscore header variants targeting the same identity field

Remediation Steps

1. 1

   Upgrade Traefik

   Update to Traefik v2.11.51, v3.6.22, v3.7.6, or later, which correctly strips underscore-variant spoofed identity headers.

2. 2

   Audit backend header normalization

   Review backend applications and frameworks for how they normalize incoming headers (CGI/WSGI-style underscore-to-dash conversion) and harden them to reject client-supplied identity headers regardless of casing or delimiter style.

3. 3

   Enforce strict header allowlisting

   Configure Traefik and backend services to explicitly strip or reject any client-supplied headers matching known identity/authorization header patterns before middleware processing, rather than relying on exact-match stripping.

4. 4

   Review ForwardAuth configurations

   Audit all ForwardAuth middleware configurations and authResponseHeaders settings to ensure unauthenticated paths cannot inject or override identity context.

5. 5

   Monitor and log anomalies

   Implement logging and alerting for requests containing duplicate or underscore-variant identity headers to detect exploitation attempts.