CVE-2026-39858 - Vulnerability Analysis

Overview

Traefik < 2.11.43, 3.6.14, and 3.7.0-rc.2 contains an authentication bypass caused by improper sanitization of forwarded-header alias variants with underscores in ForwardAuth and snippet-based middleware, letting attackers spoof trust context and bypass authentication without valid credentials.

Severity & Score

Impact

Attackers can bypass authentication on protected routes, gaining unauthorized access without valid credentials.

Mitigation

Update to versions 2.11.43, 3.6.14, 3.7.0-rc.2 or later.

References

• https://github.com/traefik/traefik/releases/tag/v3.6.14
• https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2
• https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm
• https://github.com/traefik/traefik/releases/tag/v2.11.43

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner