CVE-2026-54763 is a critical flaw (CVSS 10.0) in Traefik. The BasicAuth, DigestAuth and ForwardAuth middlewares strip dashed identity headers but not underscore variants, so a spoofed header can reach a backend that treats both forms the same. It is fixed in v2.11.51, v3.6.22 and v3.7.6.
What's affected
- Traefik before v2.11.51, before v3.6.22 and before v3.7.6, per the record.
- Fixed in v2.11.51, v3.6.22 and v3.7.6.
- Setups where a backend trusts identity headers set by Traefik, and where that backend treats underscores and dashes in header names as the same.
How to check if you're exposed
Read the Traefik version with traefik version, or the image tag.
Then work out whether your backends trust identity headers. Find the header names your applications read for user or role, for example those set through ForwardAuth authResponseHeaders. Check whether your application framework maps underscores to dashes, which many do. If a backend reads such a header and also sits behind these middlewares, you are in the described case.
What to do now
- Upgrade Traefik to v2.11.51, v3.6.22 or v3.7.6 or later.
- Set the new entry point option allowHeadersWithUnderscores to false, which strips every request header with an underscore in its name before routing. The advisory describes this as the fix.
- Test the change against your clients first, since some legacy clients send underscore headers on purpose.
- Make backends read identity from one agreed header and reject the rest where you can.
Why it matters
The classes are CWE-178, CWE-290, CWE-345: improper handling of case sensitivity, authentication spoofing, and insufficient verification of data authenticity. The Go library that Traefik uses normalizes header names by treating the dash as a word separator but leaves the underscore alone. A header with underscores was therefore stored under a different key and was not removed.
The flaw sits in the gap between two parsers. The proxy and the backend disagreed about whether two names are the same. The record does not mark the CVE as exploited in the wild. It follows an earlier fix, CVE-2026-33433, which handled only the dashed names.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to change my backends too?
The upgrade and the entry point option fix the proxy side. It is still good practice to have backends accept identity only from the header you set.
Sources
- https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5
- https://github.com/traefik/traefik/pull/13262
Last reviewed: 19 October 2026.
