CVE-2026-35051 is a maximum severity authentication bypass in Traefik's ForwardAuth middleware. NVD scores it 10.0. It applies when trustForwardHeader is false and Traefik sits behind a trusted upstream proxy. Upgrade to 2.11.43, 3.6.14 or 3.7.0-rc.2. Check which routes rely on ForwardAuth alone.
What's affected
Traefik before 2.11.43, before 3.6.14, and before 3.7.0-rc.2. Fixed versions are 2.11.43, 3.6.14 and 3.7.0-rc.2.
The record limits the issue to deployments that use ForwardAuth with trustForwardHeader set to false and run behind a trusted upstream proxy, such as a cloud load balancer or CDN.
How to check if you're exposed
Check the Traefik version:
traefik version
docker ps | grep -i traefik
Then search your static and dynamic configuration and Kubernetes resources for the forwardAuth middleware and the trustForwardHeader setting:
grep -rn "forwardAuth\|trustForwardHeader" /etc/traefik
Note which routes depend on ForwardAuth for access control and whether an upstream proxy sits in front of Traefik.
What to do now
- Upgrade Traefik to 2.11.43, 3.6.14 or 3.7.0-rc.2, based on your line. The release pages are linked under Sources.
- Identify every route protected only by ForwardAuth, and treat those as priority.
- For services behind ForwardAuth, add a second check in the application for sensitive operations until the upgrade finishes.
- Review access logs on protected routes for requests that reached the backend without a normal authentication step.
- Read the release notes for any configuration changes that come with the fix.
Why it matters
The weaknesses are CWE-345 (insufficient verification of data authenticity) and CWE-501 (trust boundary violation). ForwardAuth hands each request to an external service that decides whether it may pass. The decision depends on request metadata, and the record says a mistake in how that data is trusted lets a request through that should be refused.
A 10.0 score reflects network reach, no privileges, no user interaction, and a changed scope. The conditions are specific, but a reverse proxy sits at the front of everything it protects, so one flaw in its auth step reaches many services at once.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog. The fixes are described on the release pages; check them for further detail.
The official release pages are the source for the fixed versions. Teams often put ForwardAuth in front of internal tools such as dashboards and admin consoles, which are the services where a bypass hurts most. Make a list of those routes now, so that after the upgrade you can test that unauthenticated requests are refused.
Try it yourself
Severity alone does not tell you whether your setup is exposed. This demo shows how to check exploitability for your own configuration.
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I do not use ForwardAuth?
The record describes the ForwardAuth middleware, so setups without it are outside the described scope. Upgrading still keeps you current.
Is setting trustForwardHeader to true a fix?
I did not confirm that from the release pages. Do not change it without reading the release notes, since it alters how forwarded headers are trusted.
Sources
Last reviewed: 19 October 2026.
