Traefik allows an authenticated attacker to configure a non-canonical HTTP header name in the headerField setting (for example, "x-auth-user" instead of "X-Auth-User"). When this is done, the attacker can inject the canonical form of that header. The backend server receives two header entries; the attacker‑supplied canonical header is processed first and overrides the non‑canonical value, effectively allowing the attacker to impersonate any identity to the backend. This results in a denial of access control and could enable data exfiltration or unauthorized actions under the victim’s identity.

Traefik reverse‑proxy and load‑balancer versions prior to 2.11.42, 3.6.11, and 3.7.0‑ea.3 are affected. The vulnerability is present in all editions of the Traefik product managed through the vendor "traefik:traefik".

The CVSS score for this vulnerability is 5.1, indicating moderate severity, while the EPSS score is below 1 % and it is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated user who can modify Traefik’s headerField configuration. By injecting the canonical header, the attacker can successfully bypass authentication controls on the backend, effectively gaining impersonation privileges. Given the moderate CVSS but low exploitation probability, the risk is significant for exposed services that rely on Traefik for identity propagation.