Detections
Analytics
SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-3q9r-p662-5j8m)
medium Tenable Cloud Security Plugin ID 445744
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's
ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port
header sent to the authentication service from the original incoming request instead of the sanitized
forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https
header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the
authentication service, bypassing port-based authorization checks. This issue is fixed in versions
v2.11.51, v3.6.22, and v3.7.6. (CVE-2026-54764)
Solution
Update the github.com/traefik/traefik/v2 library and its related packages to version 2.11.51 or later.See Also
Plugin Details
Severity: Medium
ID: 445744
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/6/2026
Updated: 8/6/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2026-54764
CVSS v3
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 5.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.9
Threat Score: 2.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/6/2026
Vulnerability Publication Date: 7/4/2026
Reference Information
CVE: CVE-2026-54764
cwe: CWE-345