CVE-2022-23469 Authorization header displayed in the debug logs
Traefik exposes Authorization headers in debug logs, allowing attackers with log access to steal credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23469?
CVE-2022-23469 is a low-severity vulnerability in Traefik Traefik, published on 8 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed in the debug logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to upgrade may set the log level to `INFO`, `WARN`, or `ERROR`.
Which versions are affected by CVE-2022-23469?
4 open source packages ship an affected version, including github.com/traefik/traefik/v2 and github.com/traefik/traefik. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/traefik/traefik/v2 Go | All versions | 2.9.6 |
github.com/traefik/traefik/v2 Go | All versions | 2.9.6 |
github.com/traefik/traefik/v2 Go | All versions | 2.9.6 |
github.com/traefik/traefik Go | All versions | None |
Products include Traefik Traefik.
How do I fix CVE-2022-23469?
Upgrade github.com/traefik/traefik/v2 to 2.9.6 or later.
Is CVE-2022-23469 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23469 exists.
Other vulnerabilities in Traefik Traefik
- CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Sources
Also known as ECHO-463d-152a-b1b7, GHSA-h2ph-vhm7-g4hp, GO-2022-1154.