Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

The version of Traefik installed on the remote macOS host is prior to 2.11.43 or 3.x prior to 3.6.14. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass via StripPrefixRegex and ForwardAuth dot-segment normalization. When StripPrefixRegex     processes URLs with percent-encoded characters, it miscalculates byte offsets, producing a dot-segment path that     authentication middleware fails to match against protection rules. (CVE-2026-40912)

  - An authentication bypass via unsanitized underscore-variant forwarded headers. Traefik's forwarded-header     sanitization logic targets only canonical header names and does not strip alias variants that use underscores     instead of dashes, allowing attackers to inject forged trust context to bypass ForwardAuth. (CVE-2026-39858)

  - An authentication bypass in ForwardAuth when trustForwardHeader is set to false behind a trusted proxy. The     X-Forwarded-Prefix header remains unstripped in authentication subrequests, allowing external attackers to     spoof the header and bypass access controls on protected routes. (CVE-2026-35051)

  - A timing side-channel in BasicAuth that allows username enumeration via bcrypt short-circuit. Due to a map     key/value confusion bug, a fallback security mechanism fails to function properly, enabling attackers to     enumerate valid usernames by analyzing response-time differences. (CVE-2026-41263)

  - A Kubernetes CRD cross-namespace isolation bypass via Chain middleware references. When     allowCrossNamespace is set to false, Traefik fails to apply the same restriction to middleware references     nested inside a Chain middleware, allowing actors to access middleware from other namespaces. (CVE-2026-41174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2,
    there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based
    authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header
    names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores
    instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the
    authentication backend. When the backend normalizes underscore and dash header forms equivalently, an
    attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers
    and bypass authentication on protected routes without valid credentials. This issue has been patched in
    versions 2.11.43, 3.6.14, and 3.7.0-rc.2. (CVE-2026-39858)

ID	Name	Product	Family	Type	Severity
311474	Traefik < 2.11.43 / 3.x < 3.6.14 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high
440801	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-5m6w-wvh7-57vm)	Tenable Cloud Security	SCA Checks	Local	high
440801	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-5m6w-wvh7-57vm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-39858

high

Tenable Plugins

high

high

high