CVE-2026-54763: Authentication Bypass and Identity Spoofing in Traefik Middlewares via Header Normalization Discrepancies

Traefik functions as an HTTP edge proxy and load balancer designed to direct traffic and manage routing policies for cloud-native microservices. Within its architecture, the BasicAuth, DigestAuth, and ForwardAuth middlewares operate as vital access gates. These security boundaries validate client identities and credentials, then propagate trusted session identifiers (such as X-Auth-User) downstream to backend servers. This model assumes that any client-supplied authentication headers are completely sanitized or overwritten at the proxy layer before the request reaches internal systems.

The vulnerability, cataloged as CVE-2026-54763, lies in a fundamental asymmetry in character handling between Traefik's internal sanitization layer and downstream web application servers. Because the proxy does not scrub or validate underscore-variant headers, attackers can inject custom headers containing underscores that traverse the proxy intact. This issue primarily exposes backends running CGI, WSGI, or ASGI environments, which automatically normalize underscores and hyphens into identical internal representations.

This behavior matches the definitions of CWE-178 (Improper Handling of Case Sensitivity), CWE-290 (Authentication Bypass by Spoofing), and CWE-345 (Insufficient Verification of Data Authenticity). Unauthenticated remote attackers can leverage this flaw to spoof identity contexts, bypass authentication gates entirely, and obtain administrative access on downstream applications without presenting valid credentials.

The root cause of this vulnerability lies in the implementation of the Go standard library's net/http package and its handling of HTTP header map keys. When Go parses incoming HTTP requests, it maps headers using the textproto.CanonicalMIMEHeaderKey utility. This function normalizes headers by capitalizing characters following hyphens and converting casing, so x-auth-user or X-Auth-User resolves to the canonical key X-Auth-User. Crucially, Go's parser does not alter, normalize, or canonicalize keys containing underscores, meaning X_Auth_User remains keyed as the literal string X_Auth_User inside the request header map.

To prevent clients from injecting spoofed credentials, Traefik's authentication middlewares execute a clean-up sequence designed to remove trusted identity headers before applying the proxy's verified values. This is accomplished using Go's map deletion helper:

req.Header.Del("X-Auth-User")

Because Go uses strict, canonical string matching for this map deletion, calling Del("X-Auth-User") only matches and purges the exact key X-Auth-User. The literal key X_Auth_User is completely ignored by the deletion logic and survives the cleanup phase, remaining intact inside the forwarded HTTP request.

The final breakdown of the security boundary occurs at the backend application server. Legacy and standard application interfaces—specifically Python Gunicorn, Python uWSGI, PHP-FPM, Apache mod_cgi, and Nginx setups with underscores_in_headers on—follow CGI environment mapping specifications. These servers normalize incoming HTTP header keys into environment variables by capitalizing all characters, prefixing them with HTTP_, and converting all hyphens (-) and underscores (_) into underscores. Consequently, both the legitimate header X-Auth-User and the attacker's smuggled X_Auth_User are parsed identically as HTTP_X_AUTH_USER, allowing the attacker-controlled value to overwrite or establish the user's identity context.

Prior to the patch, Traefik relied on the standard Go Header.Del() method to sanitize authorization headers. This implementation assumed that incoming request headers would adhere to standard canonicalization rules and did not account for the loose parsing behavior of downstream CGI/WSGI environments.

To address this vulnerability, the Traefik development team introduced a commit 108a5264473a2cbc8f12d6d691a3c6553cdf2c1b that adds a custom entrypoint middleware named underscoreHeadersStrategy. This configuration supports three strategies for managing headers containing underscores: keep, delete, and reject. The two defense-oriented functions, removeHeadersWithUnderscores and rejectHeadersWithUnderscores, directly iterate through the request header map to intercept keys containing underscores.

// removeHeadersWithUnderscores removes any request header whose name contains an underscore character.
func removeHeadersWithUnderscores(h http.Handler) http.Handler {
	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
		for key := range req.Header {
			if strings.Contains(key, "_") {
				delete(req.Header, key) // Explicitly deletes underscore-variant headers
			}
		}
		h.ServeHTTP(rw, req)
	})
}
 
// rejectHeadersWithUnderscores rejects requests containing underscores with a 400 Bad Request.
func rejectHeadersWithUnderscores(h http.Handler) http.Handler {
	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
		for key := range req.Header {
			if strings.Contains(key, "_") {
				http.Error(rw, "Bad Request", http.StatusBadRequest)
				return
			}
		}
		h.ServeHTTP(rw, req)
	})
}

While this fix is highly effective at neutralizing the underscore bypass vector, it introduces a significant operational risk: the default strategy is set to keep to maintain backwards compatibility for existing infrastructure. This means that merely upgrading the binary to a patched version is insufficient; administrators must manually update their configuration to enable the delete or reject strategies. Furthermore, the fix assumes that underscores are the only character capable of causing normalization collisions. If a downstream parser normalizes other special characters, such as dots or non-ASCII characters, into hyphens, alternative bypass vectors may still exist.

An attacker seeking to exploit CVE-2026-54763 must identify a Traefik-proxied route protected by an identity-forwarding middleware, where the backend server uses CGI-style header normalization. The objective is to inject a custom identifier header that Traefik fails to strip but the backend processes as the authentic user identity.

To conduct the attack, the threat actor sends a crafted HTTP request directly to the Traefik entrypoint. The request contains the targeted backend's identity variable formatted with an underscore rather than a hyphen:

GET /internal-admin/settings HTTP/1.1
Host: vulnerable-app.target.local
X_Auth_User: administrative-operator

When Traefik receives this request, the ForwardAuth middleware processes authentication. If the middleware is configured to forward user information via X-Auth-User, it clears the canonical header. However, the custom header X_Auth_User bypasses this filter entirely. Traefik forwards the request downstream with the malicious header. Upon receipt, the backend environment (such as a Django app served via Gunicorn) normalizes X_Auth_User into HTTP_X_AUTH_USER. The application logic reads this environment variable and establishes a session as administrative-operator, resulting in a complete authentication bypass.

The impact of CVE-2026-54763 is critical, representing a total compromise of the authentication perimeter for systems relying on Traefik as an API gateway or ingress controller. By exploiting this flaw, unauthenticated attackers can gain arbitrary administrative privileges on internal microservices. This capability can be leveraged to view confidential database records, exfiltrate private data, or execute unauthorized operations inside the network.

Under CVSS v3.1, this vulnerability is assigned a score of 10.0 (Critical) due to the network-based attack vector, low complexity, absence of required privileges, and complete confidentiality and integrity impact on subsequent systems. Under CVSS v4.0, the vulnerability is rated 7.8 (High), reflecting a severe impact on the subsequent system (the downstream applications) rather than direct compromise of the proxy itself.

Currently, this vulnerability has a low EPSS score of 0.002, suggesting that wide-scale opportunistic exploitation is limited. However, because the technical mechanics are straightforward to reproduce and the underlying flaw resides in common open-source components, targeted exploits are highly likely. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and there are no reports of it being actively exploited in ransomware campaigns.

The primary remediation step is upgrading all Traefik deployments to the officially patched releases. Vulnerable versions of the 2.x branch must be updated to version 2.11.51 or higher. Legacy 3.6.x deployments must be upgraded to 3.6.22 or higher, and active 3.7.x branches must be upgraded to 3.7.6 or higher.

Because the default strategy is configured to keep for backward compatibility, administrators must explicitly configure the entrypoint to use the delete or reject strategies. If upgrading is not immediately possible, temporary workarounds should be applied at the edge or Web Application Firewall (WAF) layer. Implementing rules that reject any incoming request carrying an underscore in its header names will neutralize the attack vector.

In the long term, software development teams must transition away from trust models that rely entirely on unauthenticated HTTP header forwarding. Downstream microservices should validate incoming requests using cryptographically signed tokens (such as JSON Web Tokens or Mutual TLS) to ensure that identity assertions originated from the trusted proxy and have not been manipulated in transit.