Fabio is an HTTP(S) and TCP router that forwards headers to backends based on configuration. The 2025‑48865 patch omitted protection for operator‑configured trust headers – ClientIPHeader, TLSHeader and RequestID. As a result, any unauthenticated client can send a Connection header that removes these configured headers before they reach the backend. Backends rely on these headers for client‑IP verification, TLS termination status and request correlation. By stripping them, an attacker can cause the backend to believe the request originated from an untrusted source, potentially bypassing authentication checks or skewing audit logs. This flaw is an Improper Restriction of Operations within the Bounds of a Process (CWE‑348) and an Improper Authentication (CWE‑290).

Versions of Fabio from 1.6.6 through 1.7.1 are affected. The vulnerability was introduced in the 2025‑48865 patch, which protects only a hard‑coded list of forwarded headers and leaves the operator‑configured headers unprotected. Fabio is used in environments managed by Consul to route HTTP and TCP traffic. Any installation that has enabled the proxy.header options for ClientIPHeader, TLSHeader or RequestID in those versions is vulnerable.

The CVSS score of 5.8 indicates a moderate impact with potential damage to confidentiality and integrity. The EPSS score is not available, so the current exploitation probability is unclear. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by crafting a request that includes a Connection header designed to drop the trusted headers; this is possible for any unauthenticated client that can reach Fabio. Once the headers are removed, backends may fail to authenticate the client or may record incorrect audit information, leading to privilege escalation or data leakage.