{"id":"CVE-2026-33433","kind":"vulnerability","aliases":["CVE-2026-33433","GHSA-qr99-7898-vr7c"],"related":[],"title":"Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField","description":"## Summary\n\nThere is a potential vulnerability in Traefik's Basic and Digest authentication middlewares when `headerField` is configured with a non-canonical HTTP header name.\n\nAn authenticated attacker with valid credentials can inject the canonical version of the configured header to impersonate any identity to the backend. Because Traefik writes the authenticated username using a non-canonical map key, it creates a separate header entry rather than overwriting the attacker's canonical one — causing most backend frameworks to read the attacker-controlled value instead.\n\n## Patches\n\n- <https://github.com/traefik/traefik/releases/tag/v2.11.42>\n- <https://github.com/traefik/traefik/releases/tag/v3.6.12>\n- <https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3>\n\n## For more information\n\nIf there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n---\n\n<details>\n<summary>Original Description</summary>\n\n### Summary\n\nWhen `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject a canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write.\n\nTested on Traefik v3.6.10.\n\n### Details\n\nAt `pkg/middlewares/auth/basic_auth.go:92`, the authenticated username is written using direct map assignment:\n\n```go\nreq.Header[b.headerField] = []string{user}\n```\n\nGo's `http.Header` map is keyed by canonical names (e.g., `X-Auth-User`). Direct assignment with a non-canonical key (`x-auth-user`) creates a separate map entry from any canonical-key entry already present. The attacker's `X-Auth-User: superadmin` occupies the canonical slot and is never overwritten by Traefik's non-canonical write.\n\nThe same bug exists in `pkg/middlewares/auth/digest_auth.go:100`. Notably, `forward.go:254` correctly uses `http.CanonicalHeaderKey()`, showing the fix pattern already exists in the codebase.\n\n### PoC\n\n**Traefik config (YAML, Docker labels, or REST API):**\n\n```yaml\nmiddlewares:\n  auth:\n    basicAuth:\n      users: [\"admin:$2y$05$...\"]\n      headerField: \"x-auth-user\"\n```\n\n**Normal request (baseline):**\n\n```bash\ncurl -u admin:admin http://traefik/secure/test\n# Backend receives: x-auth-user: admin\n# Identity = admin ✓\n```\n\n**Attack request:**\n\n```bash\ncurl -u admin:admin -H \"X-Auth-User: superadmin\" http://traefik/secure/test\n# Backend receives BOTH headers:\n#   X-Auth-User: superadmin   ← attacker-injected (canonical key, read first by most frameworks)\n#   x-auth-user: admin        ← Traefik-set (non-canonical, ignored by most frameworks)\n# Identity seen by backend = superadmin ✗\n```\n\n**Control test** — when `headerField` uses canonical casing (`X-Auth-User`), the attack fails. Traefik's write correctly overwrites the attacker's header.\n\nThis is realistic because YAML conventions favor lowercase keys, Traefik docs don't warn about canonicalization, and the pattern of backends trusting the `headerField` header is recommended in Traefik's own documentation.\n\n**Fix suggestion:**\n\n```go\n// basic_auth.go:92 and digest_auth.go:100 — change:\nreq.Header[b.headerField] = []string{user}\n// to:\nreq.Header.Set(b.headerField, user)\n```\n\nAlso strip any incoming `headerField` header before the auth check with `req.Header.Del(b.headerField)`.\n\n### Impact\n\nAn authenticated attacker with valid credentials (even low-privilege) can impersonate any other user identity to backend services. If backends use the `headerField` header for authorization decisions (which is the intended use case per Traefik docs), this enables privilege escalation — e.g., a regular user impersonating an admin.\n\nThe attack requires the operator to configure `headerField` with a non-canonical header name, which is the natural thing to do in YAML and is not warned against in documentation.\n\n</details>","summary":"When Traefik's Basic or Digest auth middleware uses a non-canonical headerField name, a user with valid credentials can send a canonical version of that header and the backend reads the attacker's value. The attacker gets to impersonate any other identity the backend trusts, such as an admin.","severity":"high","cvss":8.8,"epss":0.00487,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["2.11.42"],"affected":"< 2.11.42","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["3.6.12"],"affected":">= 3.0.0-beta1, < 3.6.11","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["3.7.0-ea.3"],"affected":">= 3.7.0-ea.1, < 3.7.0-ea.3","ecosystem":"go"},{"name":"traefik","fixed":["2.11.42"],"affected":"< 2.11.42","ecosystem":"vendor"},{"name":"traefik","fixed":["3.6.12"],"affected":">= 3.0.0, < 3.6.12","ecosystem":"vendor"},{"name":"traefik","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["cwe-290","docker","go","kubernetes","runtime","self-hosted","traefik"],"not_affected_if":["auth-not-used","canonical-header-casing","header-not-trusted"],"how_to_check":"- Look for `headerField` under `basicAuth` or `digestAuth` in Traefik configuration (YAML, Docker labels, or REST API) and check whether its value contains lowercase letters, such as `x-auth-user`.\n- Check the running Traefik version with `traefik version`; the sources list `2.11.42`, `3.6.12`, and `3.7.0-ea.3` as fixed.","fix":"- Traefik v2 branch: move to `2.11.42`.\n- Traefik v3 (3.0.0-beta1 up to but not including 3.6.11): move to `3.6.12`.\n- Traefik v3 pre-release 3.7.0-ea.1 and 3.7.0-ea.2: move to `3.7.0-ea.3`.","status":"open","published_at":"2026-03-27T15:16:54+00:00","first_seen_at":"2026-11-04T03:16:03+00:00","triaged_at":"2026-11-04T03:16:17+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-04T03:16:17Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2 branch: move to `2.11.42`.\n- Traefik v3 (3.0.0-beta1 up to but not including 3.6.11): move to `3.6.12`.\n- Traefik v3 pre-release 3.7.0-ea.1 and 3.7.0-ea.2: move to `3.7.0-ea.3`.","reach":"internet","title":"Traefik: BasicAuth and DigestAuth let a user spoof identity to backends","impact":"high","summary":"When Traefik's Basic or Digest auth middleware uses a non-canonical headerField name, a user with valid credentials can send a canonical version of that header and the backend reads the attacker's value. The attacker gets to impersonate any other identity the backend trusts, such as an admin.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","docker","go"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user impersonates an admin identity to backend services","analyst_note":"","how_to_check":"- Look for `headerField` under `basicAuth` or `digestAuth` in Traefik configuration (YAML, Docker labels, or REST API) and check whether its value contains lowercase letters, such as `x-auth-user`.\n- Check the running Traefik version with `traefik version`; the sources list `2.11.42`, `3.6.12`, and `3.7.0-ea.3` as fixed.","plain_action":"","needs_analyst":false,"not_affected_if":["canonical-header-casing","auth-not-used","header-not-trusted"],"who_is_affected":"Exposure requires Traefik to front a backend that trusts the header set by headerField, and a headerField configured with non-canonical casing such as lowercase. Attackers also need valid credentials for the basic or digest auth middleware, though any such user (even low-privilege) can impersonate others. Deployments that use canonical header casing like X-Auth-User, or that do not rely on the header for authorization, are not affected by the sources' description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000953,"input_tokens":5754,"output_tokens":755,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-290':36B '-33433':14A,22A '/details':640C '/traefik/traefik/issues).':212C '/traefik/traefik/releases/tag/v2.11.42':186C '/traefik/traefik/releases/tag/v3.6.12':189C '/traefik/traefik/releases/tag/v3.7.0-ea.3':192C '/traefik/traefik/v2':25A '/traefik/traefik/v3':28A,31A '05':400C '100':369C '2y':399C '7898':18A '92':286C 'admin':95B,398C,412C,413C,421C,423C,429C,430C,461C,608C 'advisori':205C 'alreadi':338C,379C 'also':547C 'api':392C 'assign':295C,316C 'attack':78B,82B,124C,167C,179C,241C,265C,341C,424C,448C,489C,497C,563C,610C 'attacker-control':178C 'attacker-inject':264C,447C 'auth':51B,231C,237C,313C,325C,345C,395C,404C,419C,434C,444C,459C,486C,555C 'authent':108C,123C,148C,240C,288C,562C 'author':587C 'b.headerfield':298C,540C,545C,559C 'backend':75B,90B,143C,173C,256C,258C,415C,438C,475C,520C,578C,581C 'baselin':408C 'bash':409C,426C 'basic':48B,105C 'basic_auth.go:92':535C 'basicauth':396C 'basicauth/digestauth':4A 'bug':365C 'canon':10A,57B,68B,118C,131C,154C,169C,224C,245C,267C,277C,308C,321C,335C,350C,361C,450C,467C,482C,621C 'canonic':515C 'canonical-key':334C 'case':483C,594C 'caus':171C 'chang':538C 'check':556C 'codebas':383C 'comment':202C 'config':386C 'configur':113C,135C,219C,615C 'control':180C,477C 'convent':505C 'correct':372C,494C 'creat':158C,327C 'credenti':64B,127C,566C 'curl':410C,427C 'cve':12A,20A 'cwe':35B 'decis':588C 'descript':214C 'detail':283C 'digest':50B,107C 'digest_auth.go:100':537C 'direct':293C,315C 'doc':510C,597C 'docker':37B,388C 'document':531C,639C 'e.g':228C,310C,602C 'enabl':599C 'entri':162C,262C,331C,337C 'escal':601C 'even':567C 'exist':366C,380C 'fail':490C 'favor':506C 'first':271C,453C 'fix':377C,532C 'forward.go:254':371C 'framework':174C,456C,471C 'get':83B 'ghsa':16A 'ghsa-qr99':15A 'github.com':24A,27A,30A,185C,188C,191C,211C 'github.com/traefik/traefik/issues).':210C 'github.com/traefik/traefik/releases/tag/v2.11.42':184C 'github.com/traefik/traefik/releases/tag/v3.6.12':187C 'github.com/traefik/traefik/releases/tag/v3.7.0-ea.3':190C 'github.com/traefik/traefik/v2':23A 'github.com/traefik/traefik/v3':26A,29A 'go':38B,296C,301C,534C 'h':431C 'header':72B,120C,136C,161C,226C,249C,261C,441C,499C,524C,552C,585C,622C 'headerfield':11A,58B,111C,217C,401C,480C,523C,551C,584C,616C 'host':43B 'http':119C,225C 'http.canonicalheaderkey':374C 'http.header':303C 'ident':5A,88B,140C,253C,422C,472C,576C 'ignor':468C 'impact':560C 'imperson':85B,138C,251C,572C,606C 'incom':550C 'inform':195C 'inject':129C,243C,266C,449C 'instead':182C,233C 'intend':592C 'issu':209C 'key':156C,306C,322C,336C,451C,508C 'kubernet':39B 'label':389C 'low':569C 'low-privileg':568C 'lowercas':507C 'map':155C,294C,304C,330C 'middlewar':52B,109C,394C 'name':59B,121C,227C,309C,623C 'natur':627C 'never':354C 'non':9A,56B,117C,153C,223C,276C,320C,360C,466C,620C 'non-canon':8A,55B,116C,152C,222C,275C,319C,359C,465C,619C 'normal':406C 'notabl':370C 'occupi':348C 'one':170C,268C 'open':207C 'oper':613C 'origin':213C 'overrid':272C 'overwrit':165C,495C 'overwritten':355C 'patch':183C 'pattern':378C,518C 'per':595C 'pkg/middlewares/auth/basic_auth.go':285C 'pkg/middlewares/auth/digest_auth.go':368C 'pleas':206C 'poc':384C 'potenti':100C 'present':339C 'privileg':570C,600C 'qr99':17A 'question':200C 'rather':163C 'read':76B,176C,270C,452C 'realist':502C 'receiv':259C,416C,439C 'recommend':526C 'regular':604C 'req.header':297C,539C 'req.header.del':558C 'req.header.set':544C 'request':407C,425C 'requir':611C 'rest':391C 'runtim':40B 'seen':473C 'self':42B 'self-host':41B 'send':66B 'separ':160C,329C 'servic':579C 'set':464C 'show':375C 'slot':351C 'spoof':6A 'string':299C,541C 'strip':548C 'suggest':533C 'summari':96C,215C 'superadmin':347C,436C,446C,476C 'test':279C,478C 'thing':628C 'traefik':1A,32A,33A,34A,44B,46B,103C,145C,273C,281C,357C,385C,463C,491C,509C,528C,596C 'traefik-set':462C 'traefik/secure/test':414C,437C 'trust':91B,521C 'two':260C 'u':411C,428C 'use':53B,150C,292C,373C,481C,582C,593C 'user':61B,232C,238C,300C,314C,326C,346C,397C,405C,420C,435C,445C,460C,487C,542C,546C,575C,605C 'usernam':149C,289C 'v3.6.10':282C 'valid':63B,126C,565C 'valu':80B,181C 'version':69B,132C,246C 'via':7A 'vr7c':19A 'vulner':2A,101C 'warn':513C,636C 'write':146C,278C,362C,493C 'written':291C 'x':230C,236C,312C,324C,344C,403C,418C,433C,443C,458C,485C 'x-auth-us':229C,235C,311C,323C,343C,402C,417C,432C,442C,457C,484C 'yaml':387C,393C,504C,632C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires Traefik to front a backend that trusts the header set by headerField, and a headerField configured with non-canonical casing such as lowercase. Attackers also need valid credentials for the basic or digest auth middleware, though any such user (even low-privilege) can impersonate others. Deployments that use canonical header casing like X-Auth-User, or that do not rely on the header for authorization, are not affected by the sources' description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3","traefik"],"ptokens":["com","github","traefik","v2","v3"],"labels":["cwe290","docker","go","high","kubernetes","runtime","selfhosted","traefik","vendor"],"campaign_type":null,"first_public_at":"2026-03-27T10:29:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qr99-7898-vr7c","url":"https://github.com/advisories/GHSA-qr99-7898-vr7c","severity":"medium","published_at":"2026-03-27T20:35:53+00:00","modified_at":"2026-11-04T03:14:42+00:00","first_seen_at":"2026-11-04T03:16:03+00:00","fetched_at":"2026-11-04T03:16:03+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-33433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33433","severity":null,"published_at":"2026-03-27T15:16:54+00:00","modified_at":"2026-07-15T02:20:13+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63412,"url":"https://api.github.com/repos/traefik/traefik/security-advisories/GHSA-qr99-7898-vr7c","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63413,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-qr99-7898-vr7c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-03-27T10:29:14+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63414,"url":"https://github.com/traefik/traefik/releases/tag/v2.11.42","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":63415,"url":"https://github.com/traefik/traefik/releases/tag/v3.6.11","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":63416,"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}