The vulnerability exists in Traefik’s handling of forwarded headers used by ForwardAuth and snippet-based authentication middleware. The sanitization logic removes only canonical header names such as X-Forwarded-Proto, but it fails to strip or normalize alias forms that replace dashes with underscores. As a result, an attacker can send headers like X_Forwarded_Proto to inject a forged trust context, which the authentication backend normalizes equivalently. This allows bypassing authentication on protected routes without valid credentials.

Affected systems are Traefik installations provided by the traefik:traefik vendor. Any deployment running Traefik 2.x before v2.11.43 and any 3.x before v3.6.14 or v3.7.0-rc.2 is vulnerable. The fix is included in the releases 2.11.43, 3.6.14, and 3.7.0-rc.2.

The CVSS score of 7.8 indicates a high severity assessment. Because the exploit only requires crafting an HTTP request with underscore‑based header aliases, no special privileges or internal access are needed, making it relatively easy to execute. The EPSS score is 0.00061, indicating a very low probability of exploitation, but it is non‑zero, so the vulnerability can still be exploited. The vulnerability is not yet listed in CISA KEV. An attacker can trigger the bypass by sending a request to the Traefik front‑end, so organizations using the affected versions should apply the patch promptly.