Traefik Authentication Bypass Vulnerability in ForwardAuth and Snippet-Based Middleware

A high-severity authentication bypass vulnerability has been identified in Traefik's ForwardAuth and snippet-based authentication middleware. This issue affects Traefik versions through v2.11.42, v3.6.13, and v3.7.0-rc.1. The vulnerability arises because Traefik's sanitization logic for forwarded headers only addresses canonical names, such as X-Forwarded-Proto, and fails to normalize alias variants that use underscores instead of dashes. As a result, these unsanitized alias headers are forwarded to the authentication backend, where an attacker can inject spoofed trust context, such as a trusted scheme or host, to bypass authentication on protected routes without valid credentials.

Impact

Exploitation of this vulnerability allows attackers to bypass authentication on protected routes, gaining access without valid credentials.

Remediation

Users can upgrade to Traefik versions 2.11.43, 3.6.14, or 3.7.0-rc.2 to address this vulnerability.