{"id":"CVE-2026-88011","aliases":["CVE-2026-88879","GHSA-rf44-j88r-hh8c","GO-2026-6455"],"url":"https://o3.security/vulnerability/CVE-2026-88011","summary":"Traefik: ForwardAuth identity spoofing via dot-form header alias","details":"## Summary\n\nThere is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so `X-Auth-User`, `X_Auth_User` and `X.Auth.User` are three distinct headers to Traefik, while backends that derive variable names from header names (CGI, WSGI, PHP, NGINX, and others) collapse all of them into the same variable. A client can therefore smuggle an alias of a header that Traefik manages past the middleware managing it — for example a dot-form `X.Authenticated.User` alongside the canonical `X-Authenticated-User` written by the ForwardAuth middleware — and have such a backend read the client-supplied value instead of the identity Traefik asserted. Any header Traefik sets is exposed, not only ForwardAuth's. This is an incomplete-fix sibling of GHSA-x677-9fxg-v5c5, which blocked only the underscore form.\n\nThe mitigation is the new `aliasHeadersStrategy` entry point option. It defaults to `keep`, which preserves the previous behavior for backwards compatibility, so it must be explicitly set to `delete` or `reject` to take effect.\n\nTraefik v1.x, the v2 releases up to v2.11.55 and the v3 releases from v3.0.0 to v3.7.11 are affected. The unmaintained lines among them will not receive a patch of their own, and the remedy for their users is to upgrade to v2.11.56 or v3.7.12 and set `aliasHeadersStrategy`.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.56\n- https://github.com/traefik/traefik/releases/tag/v3.7.12\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n### Summary\nTraefik's ForwardAuth middleware removes the configured canonical identity header before copying the value returned by the auth service. However, a client-supplied dot-form alias such as `X.Authenticated.User` survives both this replacement and `underscoreHeadersStrategy: delete`.\n\nThe tested PHP 8.2 built-in SAPI maps `X-Authenticated-User` and `X.Authenticated.User` to the same `HTTP_X_AUTHENTICATED_USER` server variable. In Traefik's tested HTTP/1 backend path, the client value is serialized last and overrides the identity asserted by ForwardAuth.\n\nA client whom ForwardAuth permits as a lower-privilege identity can therefore be treated by the backend as another user or role.\n\n### Details\nAt `v3.7.10`, `pkg/server/server_entrypoint_tcp.go:800-818` removes or rejects only names containing `_`. After successful authentication, `pkg/middlewares/auth/forward.go:314-326` deletes and replaces only the canonical `authResponseHeaders` key. The dot alias remains in `req.Header` and the standard reverse proxy forwards both legal field names.\n\nGo's HTTP/1 writer sorts header names lexically, placing `X-Authenticated-User` before `X.Authenticated.User`. PHP then collapses both into one `$_SERVER` key, so the attacker value deterministically wins.\n\nThis is an incomplete-fix sibling of `GHSA-x677-9fxg-v5c5`: the published underscore input is blocked by the new entry-point strategy, while the dot input bypasses that mitigation on the current stable release.\n\n### PoC\n[traefik-dot-forwardauth-poc.zip](https://github.com/user-attachments/files/30898195/traefik-dot-forwardauth-poc.zip)\n\nrun:\n```bash\ndocker compose up -d\nbash verify.sh\ndocker compose down\n```\n\nThe decisive request is:\n\n```http\nGET /probe HTTP/1.1\nHost: 127.0.0.1:18080\nX.Authenticated.User: admin\nConnection: close\n```\n\nExpected backend identity: `lab-user`, as returned by ForwardAuth.\n\nObserved on `v3.7.10`: `admin`.\n\nThe script also verifies that requests without the alias, with the canonical header, and with the already-fixed underscore alias all produce `lab-user`.\n\n### Impact\nApplications that authorize requests using a ForwardAuth-provided identity header can receive an attacker-selected username or role instead. This was runtime-verified with PHP 8.2.27 and 8.2.33; impact on other normalization-prone backends is conditional. A lower-privilege permitted client may consequently impersonate another user or administrative role, affecting confidentiality and integrity.\n\nThis report does not claim bypass of a ForwardAuth denial: the auth service must first permit the request.\n\n\n</details>\n---","published":"2026-09-10T15:31:55.215Z","modified":"2026-10-28T02:31:09.886286585Z","cvss":null,"epss":{"score":0.00235,"percentile":0.14602,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","fixedVersion":"2.11.56"},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","fixedVersion":"3.7.12"}],"fix":{"url":"https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8","label":"traefik/traefik@0331801"},"references":[{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v2.11.56"},{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v3.7.12"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88011.json"},{"type":"ADVISORY","url":"https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88011"},{"type":"FIX","url":"https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8"},{"type":"FIX","url":"https://github.com/traefik/traefik/pull/13720"},{"type":"PACKAGE","url":"https://github.com/traefik/traefik"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:09.886286585Z"}}