Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers (such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port, etc.) via the Connection header does not handle case sensitivity correctly. The Connection tokens are compared case-sensitively against the protected header names, but the actual header deletion operates case-insensitively. As a result, a remote unauthenticated client can use lowercase Connection tokens (e.g. Connection: x-real-ip) to bypass the protection and trigger the removal of Traefik-managed forwarded identity headers. This issue has been patched in versions 2.11.38 and 3.6.9.

The version of Traefik installed on the remote macOS host is 2.11.x prior to 2.11.38 or 3.x prior to 3.6.9. It is, therefore, affected by a vulnerability:

  - A flaw exists in HTTP/1.1 request handling due to case-sensitive comparison of Connection header tokens     against protected header names. An unauthenticated, remote attacker can exploit this, via lowercase     Connection tokens, to bypass protection and trigger the removal of Traefik-managed forwarded identity     headers. (CVE-2026-29054)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3
    to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded
    headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of
    Traefik-managed X-Forwarded headers (such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port, etc.) via the
    Connection header does not handle case sensitivity correctly. The Connection tokens are compared case-
    sensitively against the protected header names, but the actual header deletion operates case-
    insensitively. As a result, a remote unauthenticated client can use lowercase Connection tokens (e.g.
    Connection: x-real-ip) to bypass the protection and trigger the removal of Traefik-managed forwarded
    identity headers. This issue has been patched in versions 2.11.38 and 3.6.9. (CVE-2026-29054)

ID	Name	Product	Family	Severity
318670	Traefik 2.11.x < 2.11.38 / 3.x < 3.6.9 Connection Header Bypass	Nessus	MacOS X Local Security Checks	high
438340	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-92mv-8f8w-wq52)	Tenable Cloud Security	SCA Checks	high
438340	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-92mv-8f8w-wq52)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-29054

high

Tenable Plugins

high

high

high