p PatchFirst

CVE-2026-33433

CVE-2026-33433 · Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.

CVSS 5.1 · Media · EPSS 0,6%

Publicación
Actualización

Pila tecnológica: web

Productos y versiones afectados

  • traefik

    Versiones
    • < 2.11.42: Afectada
    • >= 3.0.0-beta1, < 3.6.11: Afectada
    • >= 3.7.0-ea.1, < 3.7.0-ea.3: Afectada

    Sin corrección publicada

Fuentes originales

Comprueba tu servidor →