The Traefik errors middleware wrongly forwards the complete set of request headers—including Authorization, Cookie, and other authentication tokens—to the separate error page service when a backend response matches the configured status range. The documentation denotes that only the Host header is forwarded by default, so operators are not warned that sensitive credentials are being shared across service boundaries. This unexpected exposure of authentication material could allow attackers to obtain user credentials from the error page service, and based on the description it is inferred that this might enable session hijacking or impersonation, although such exploits are not explicitly reported in the provided data.

Traefik versions before 2.11.44, 3.6.15, and 3.7.0‑rc.3 are impacted when the errors middleware is enabled with a distinct error page service.

The CVSS score of 6.9 reflects moderate severity. The EPSS score is not available, implying no publicly known exploitation data. The vulnerability is not listed in the CISA KEV catalog. The suspect attack vector is an attacker‑controlled or compromised error page service that receives forwarded authentication headers, inferred from the description; exploitation requires that the errors middleware is active and a backend response triggers the error handling path. No public exploit has been reported for this issue.