Live › vulnerability › CVE-2026-62987
Go to dashboardFabio, a Go HTTP and TCP router for Consul-managed apps, lets an unauthenticated client name and strip the operator-configured trust headers (client IP, TLS, request ID) using the Connection header. Backends that rely on those headers for authorization or audit can be fooled into losing or misreading the real client IP or TLS state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/fabiolb/fabio | go | >= 1.6.6, < 1.7.2 | 1.7.2 |
1.6.6 up to but not including 1.7.21.7.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-62987")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.