Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until
    3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement
    and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while
    normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently
    consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any
    header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be
    configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12. (CVE-2026-88011)

ID	Name	Product	Family	Type	Severity
463419	Echo: github.com/traefik/traefik/v3: security update to 2.11.56	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463419	Echo: github.com/traefik/traefik/v3: security update to 2.11.56	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
447933	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-rf44-j88r-hh8c)	Tenable Cloud Security	SCA Checks	Local	medium
447933	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-rf44-j88r-hh8c)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-88011

medium

Tenable Plugins

medium

medium

medium

medium