CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
Attackers can spoof X-Forwarded-Proto to bypass port-based authorization checks in Traefik's ForwardAuth middleware, even when trustForwardHeader is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54764?
CVE-2026-54764 is a medium-severity vulnerability in Traefik Traefik, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
Weakness: CWE-345
Which versions are affected by CVE-2026-54764?
11 open source packages ship an affected version, including github.com/traefik/traefik/v3, github.com/traefik/traefik and github.com/traefik/traefik/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/traefik/traefik/v3 Go | All versions | 3.6.22, 3.7.6 |
github.com/traefik/traefik/v3 Go | All versions | 3.6.22 |
github.com/traefik/traefik/v3 Go | All versions | 3.6.22 |
github.com/traefik/traefik/v3 Go | From 3.7.0 | 3.7.6 |
github.com/traefik/traefik/v3 Go | From 3.7.0 | 3.7.6 |
github.com/traefik/traefik Go | All versions | None |
5 more packages
github.com/traefik/traefik Go | All versions to 1.7.34 | None |
github.com/traefik/traefik Go | All versions to 1.7.34 | None |
github.com/traefik/traefik/v2 Go | All versions | 2.11.51 |
github.com/traefik/traefik/v2 Go | All versions | 2.11.51 |
github.com/traefik/traefik/v2 Go | All versions | 2.11.51 |
Products include Traefik Traefik.
How do I fix CVE-2026-54764?
Upgrade github.com/traefik/traefik/v3 to a fixed version for your release line: 3.6.22 or 3.7.6.
Is CVE-2026-54764 being exploited?
There is no known exploitation of CVE-2026-54764 in the wild and no public exploit code.
Other vulnerabilities in Traefik Traefik
- CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Sources
Also known as GHSA-3q9r-p662-5j8m, GO-2026-6202, MINI-97rh-fm88-394x, MINI-hxxh-4x85-8c3p, MINI-vhpw-52wf-c9m3.