CVE-2026-88011

    Dashboard / Vulnerabilities / CVE-2026-88011

    CVE-2026-88011

    Published: 10 Sept 2026Last Modified: 11 Sept 2026

    Summary: Traefik: ForwardAuth identity spoofing via dot-form header alias

    Details: Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88011.json, https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8, https://github.com/traefik/traefik/pull/13720, https://github.com/traefik/traefik/releases/tag/v2.11.56, https://github.com/traefik/traefik/releases/tag/v3.7.12, https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c, https://nvd.nist.gov/vuln/detail/CVE-2026-88011

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d87731461f0c7beb6fdbcc5a5655a44ce56e537a

    Affected versions

    v3.7.11
    v3.7.10
    v3.7.9
    v3.7.8
    v3.7.7
    v3.7.6
    v3.7.5
    v3.7.4
    v3.7.3
    v3.7.2
    v3.7.1
    v3.7.0
    v3.7.0-rc.3
    v3.7.0-rc.2
    v3.7.0-rc.1
    v3.7.0-ea.3
    v3.7.0-ea.1
    v3.7.0-ea.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-88011 | CVE-DB