CVE-2026-54764
Fixed in a distro release EPSS <1%CVSS 6.9
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
Products: traefik
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/traefik/traefik | no fix |
| Go | github.com/traefik/traefik/v2 | 2.11.51 |
| Go | github.com/traefik/traefik/v3 | 3.6.22 |
| Go | github.com/traefik/traefik/v3 | 3.7.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE:Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |
| openSUSE:Tumbleweed | traefik | 3.7.7-1.1 |
| openSUSE:Tumbleweed | traefik2 | 2.11.52-1.1 |