CVE-2026-88879: High Header Alias Spoofing in Traefik

CVE-2026-88879 is a high severity header alias spoofing flaw in Traefik, scored 8.2. Traefik v2.11.56 and v3.7.12, with aliasHeadersStrategy set to delete or reject. Check your installed version against the affected list below, then patch or restrict access until you can. The record does not flag it as exploited.

What's affected

• Traefik v1.x (unmaintained, no patch planned), v2.x through v2.11.55, and v3.0.0 through v3.7.11.

Severity in the record: High (8.2), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. Weakness: CWE-290.

Fix: Traefik v2.11.56 and v3.7.12, with aliasHeadersStrategy set to delete or reject. Unmaintained lines will not be patched.

The two Traefik records for this advisory differ slightly: CVE-2026-88011 is scored 8.1 and lists v2 before 2.11.56 and v3.0.0 until 3.7.12, while this record is scored 8.2 and also names v1.x. Both are stated here.

How to check if you're exposed

1. Run traefik version or check your container image tag.
2. Search configuration for aliasHeadersStrategy: grep -rn aliasHeadersStrategy /etc/traefik.
3. Identify backends that derive variable names from header names, such as CGI, WSGI, PHP and NGINX.

Run these on every host, image and build that could carry the component. Dependency files in repositories and base images in registries are easy to miss.

What to do now

1. Confirm the version of every affected system using the checks above.
2. Read the vendor advisory linked in Sources and note the fixed version for your release line.
3. Schedule the update, starting with systems that face untrusted networks or hold the most sensitive data.
4. In the meantime: if you run Traefik v1, plan a migration. No patch will arrive.
5. Record the change, then recheck the version to confirm it took effect.

Why it matters

Traefik canonicalizes header names only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are three headers to Traefik but may collapse into one variable at the backend. A client can add a dot-form alias next to the identity header that ForwardAuth wrote. In the tested configuration (PHP 8.2 built-in SAPI over HTTP/1), header ordering makes the client value win. The record calls it an incomplete fix for GHSA-x677-9fxg-v5c5, which blocked only the underscore form. Weakness: CWE-290.

The record's KEV flag is false, so this post makes no claim that the flaw is exploited in the wild. That can change, so recheck the CISA catalog from time to time.

Libraries like this often arrive as transitive dependencies, so the version in your lockfile may not be one you chose. Safeguard's free in-browser dependency scan can show whether the package is in a project, and reachability analysis helps separate code paths that call the weak function from those that never do.

The vector string in the record is a compact summary of how the flaw is reached and what it costs. AV is the attack vector (network, adjacent or local), PR is the privilege the attacker needs, and the C, I and A letters give the impact on confidentiality, integrity and availability. Read it against your own network layout rather than relying on the score alone.

After you patch

Patching is not the end of the job. Recheck the version on each system, because an upgrade that failed or rolled back looks the same as a success until someone looks. Keep the advisory link with your change record so the next reviewer can see why the update happened.

If you cannot patch soon, write down the reason, the compensating control you chose and a date to revisit. Exceptions without a date tend to become permanent.

Quick check

Sources

• Traefik: GHSA-rf44-j88r-hh8c

• VulnCheck advisory

• Safeguard Gold: CVE-2026-88879

Last reviewed: 18 October 2026.