Traefik’s BasicAuth, DigestAuth, and ForwardAuth middlewares remove canonical-cased spoofed identity headers before setting their own values, but they ignore headers that use underscore variants of the name. Many internal backends normalize underscore and dash forms to the same header, so an attacker who can reach a protected route can inject an underscore-variant header that survives the middleware’s filtering. The injected header then arrives at the backend in place of or alongside the intended authentication value, allowing the attacker to spoof the authenticated user or modify the authorization context. This flaw is compliant with CWE-178, CWE-290, and CWE-345.

All Traefik releases prior to v2.11.51, v3.6.22, and v3.7.6 that use BasicAuth, DigestAuth, or ForwardAuth middlewares are affected. Deployments relying on these authentication components are vulnerable until the corresponding fixed versions are applied and the authentication path is protected from underscore-variant headers.

With a CVSS score of 7.8 the vulnerability is rated high severity, but its EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. It is not listed in CISA KEV, and the attack requires the ability to send a crafted HTTP request to a route protected by one of the affected middlewares. Successful exploitation results in identity spoofing or unauthorized authorization on downstream services that treat underscore and dash header names equivalently.