CVE-2026-33433 PUBLISHED

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField

Assigner: GitHub_M
Reserved: 19.03.2026 Published: 27.03.2026 Updated: 27.03.2026

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name (e.g., x-auth-user instead of X-Auth-User), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
CVSS Score: 5.1

Product Status

Vendor traefik
Product traefik
Versions
  • Version < 2.11.42 is affected
  • Version >= 3.0.0-beta1, < 3.6.11 is affected
  • Version >= 3.7.0-ea.1, < 3.7.0-ea.3 is affected

References

Problem Types

  • CWE-290: Authentication Bypass by Spoofing CWE