7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35051

CVE-2026-35051: Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35051

CVE-2026-35051:

7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v3	go	>= 3.7.0-ea.1, < 3.7.0-rc.2	3.7.0-rc.2
github.com/traefik/traefik/v3	go	>= 3.0.0-beta1, < 3.6.14	3.6.14
github.com/traefik/traefik/v2	go	< 2.11.43	2.11.43
github.com/traefik/traefik	go	<= 1.7.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Traefik's ForwardAuth middleware, which fails to properly sanitize X-Forwarded-Prefix headers when trustForwardHeader=false. An attacker can send a request with a spoofed X-Forwarded-Prefix header to a Traefik instance that is behind a trusted reverse proxy. The ForwardAuth middleware, specifically the writeHeader function in pkg/middlewares/auth/forward.go, would then forward this malicious header to the backend authentication service. If the authentication service uses the value of this header to make authorization decisions, it can be tricked into granting access to protected routes.

The vulnerability is particularly exploitable when the StripPrefix middleware is used before ForwardAuth. StripPrefix adds its own X-Forwarded-Prefix header, but because the attacker's header is not removed, the request to the auth service contains both. If the auth service processes the first X-Forwarded-Prefix header it sees, it will use the attacker's value, leading to an authentication bypass.

The patch addresses this by modifying the writeHeader function to explicitly delete all X-Forwarded-* headers when trustForwardHeader is false, using a new DeleteXForwardedHeaders function. For backward compatibility, the old, vulnerable logic was moved to a new function, oldWriteHeader, which is called with a warning if trustForwardHeader is not explicitly configured.

Vulnerable functions

forwardAuth.ServeHTTP

pkg/middlewares/auth/forward.go

This is the main middleware handler function that receives the incoming HTTP request. It is responsible for creating the forward request to the authentication server and calling the `writeHeader` function to populate the headers. It is the entry point to the vulnerable logic.

writeHeader

pkg/middlewares/auth/forward.go

Prior to the patch, this function was responsible for preparing the headers of the request sent to the authentication server. It copied headers from the original request but failed to remove the `X-Forwarded-Prefix` header when `trustForwardHeader` was set to `false`. This allowed an attacker-controlled header to be passed to the authentication service. The vulnerable logic was moved to `oldWriteHeader` after the patch.

oldWriteHeader

pkg/middlewares/auth/forward.go

After the patch, this function contains the original vulnerable code from `writeHeader`. It is called for backward compatibility when `trustForwardHeader` is not explicitly set. It copies headers from the incoming request to the authentication request without stripping the `X-Forwarded-Prefix` header, thus preserving the vulnerability under this specific configuration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.