CVE-2026-39858 is a critical authentication bypass (CVSS 10.0) in Traefik's ForwardAuth and snippet based authentication middleware. Header sanitization handled only canonical names, so underscore variants such as X_Forwarded_Proto reached the auth backend and could spoof trust. Fixed in 2.11.43, 3.6.14 and 3.7.0-rc.2.
What's affected
Traefik before 2.11.43, before 3.6.14, and 3.7.0 builds before 3.7.0-rc.2 are affected. The fixed versions are 2.11.43, 3.6.14 and 3.7.0-rc.2.
The bypass depends on the authentication backend. It applies when the backend treats underscore and dash header names as the same, per the advisory.
How to check if you're exposed
traefik version
docker ps --format '{{.Image}}' | grep -i traefik
kubectl get pods -A -o jsonpath='{..image}' | tr ' ' '\n' | grep -i traefik
Then list routes protected by the ForwardAuth middleware and find out how each auth backend reads forwarded headers.
What to do now
- Upgrade to 2.11.43, 3.6.14 or 3.7.0-rc.2, matching your line.
- Read the v3.6.14 migration notes, which the release points to for upgrade guidance.
- Check whether your auth backend treats X_Forwarded_Proto and X-Forwarded-Proto as the same header.
- Review access logs on protected routes for unauthenticated successes.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
The record lists CWE-289 (Authentication Bypass by Alternate Name), CWE-290 (Authentication Bypass by Spoofing) and CWE-306 (Missing Authentication for Critical Function). The proxy removed forwarded headers by their canonical names but let alias spellings through. Many backends and frameworks normalize underscores to dashes, so the alias arrives looking like a trusted header.
The release notes list the fix as removing untrusted X headers with underscores. When a proxy and a backend disagree about what a header name means, the gap is a security issue. The record does not flag this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is every Traefik deployment exposed?
Not necessarily. The advisory ties the bypass to ForwardAuth or snippet auth and a backend that normalizes underscores.
Where is the release note?
The v3.6.14 release lists 'Remove untrusted X headers with underscores'.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
