Ce mail provient de l'extérieur, restons vigilants

====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN714
_____________________________________________________________________


DATE                : 02/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Traefik versions prior to 3.7.6,
                                    3.6.22, 2.11.51.
 
====================================================================
https://github.com/traefik/traefik/security/advisories/GHSA-x677-9fxg-v5c5
https://github.com/traefik/traefik/security/advisories/GHSA-6p8f-p8j2-rqmv
_____________________________________________________________________


Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort:
headerField underscore-variant identity spoofing in
BasicAuth / DigestAuth / ForwardAuth

High
mmatur published GHSA-x677-9fxg-v5c5

Package
github.com/traefik/traefik/v2 (Go)

Affected versions
<= v2.11.50

Patched versions
v2.11.51

github.com/traefik/traefik/v3 (Go)
Affected versions
<= v3.6.21
<= v3.7.5
Patched versions
v3.6.22
v3.7.6


Description

Summary

There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth,
and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased
spoofed identity headers (e.g. X-Auth-User) before writing Traefik's own value,
but did not account for underscore-variant header names (e.g. X_Auth_User),
which many backends normalize identically to the dashed form. An attacker able
to reach a protected route could inject an underscore-variant header that
survives Traefik's stripping and reaches the backend alongside — or, on the
unauthenticated ForwardAuth authResponseHeaders path, instead of — the value
Traefik intended to set, spoofing identity or authorization context. This is
fixed by setting the new allowHeadersWithUnderscores: false entry point option,
which strips all headers with underscores in their names before routing.


Patches

    https://github.com/traefik/traefik/releases/tag/v2.11.51
    https://github.com/traefik/traefik/releases/tag/v3.6.22
    https://github.com/traefik/traefik/releases/tag/v3.7.6

For more information

If you have any questions or comments about this advisory, please open an
issue.

Original Description


Severity
High

CVE ID
CVE-2026-54763

Weaknesses
Weakness CWE-178
Weakness CWE-290
Weakness CWE-345

Credits

    @matte1782 matte1782 Reporter
_____________________________________________________________________


Gateway HTTPRoute backendRef filters can leak backend context across
routes sharing a Service:port

Moderate
mmatur published GHSA-6p8f-p8j2-rqmv

Package
github.com/traefik/traefik/v3 (Go)

Affected versions
>= v3.7.0, <= v3.7.5

Patched versions
v3.7.6


Description

Summary

There is a medium severity vulnerability in Traefik's Kubernetes
Gateway API provider.
When two accepted HTTPRoutes target the same backend Service:port but
configure different backendRef filters, Traefik may resolve both routes
to the same child service and apply only one route's filter set to all
requests reaching that backend. In Gateway deployments where backendRef
filters set security-sensitive headers — such as tenant identity,
authorization context, or values the backend trusts — an attacker who
can create an accepted HTTPRoute sharing the same backend Service:port
may cause their route's filter context to be applied to another route's
requests, potentially crossing namespace boundaries when a ReferenceGrant
permits cross-namespace targeting.


Patches

    https://github.com/traefik/traefik/releases/tag/v3.7.6


For more information

If you have any questions or comments about this advisory, please
open an issue.


Original Description


Severity
Moderate

CVE ID
CVE-2026-54765

Weaknesses
Weakness CWE-284
Weakness CWE-863

Credits

    @gooood4u gooood4u Reporter


========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
========================================================