{"id":"CVE-2026-62987","kind":"vulnerability","aliases":["CVE-2026-62987","GHSA-fq95-v8xc-jm3v","GO-2026-6566"],"related":[],"title":"Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header in github.com/fabiolb/fabio","description":"Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.","summary":"Fabio, a Go HTTP and TCP router for Consul-managed apps, lets an unauthenticated client name and strip the operator-configured trust headers (client IP, TLS, request ID) using the Connection header. Backends that rely on those headers for authorization or audit can be fooled into losing or misreading the real client IP or TLS state.","severity":"medium","cvss":5.8,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/fabiolb/fabio","fixed":["1.7.2"],"affected":">= 1.6.6, < 1.7.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["consul","fabio","go","package","self-hosted"],"not_affected_if":["default-config","version-1.7.2-or-later"],"how_to_check":"Check whether the fabio config sets proxy.header.clientip, proxy.header.tls or proxy.header.requestid to a non-empty value.\nCheck the fabio version with fabio -version; affected range is 1.6.6 up to but not including 1.7.2.","fix":"Upgrade fabio to 1.7.2 or later.\nUntil then, stop backends from trusting the client IP or TLS header values that arrive through fabio, or unset those proxy.header options if they are not needed.","status":"open","published_at":"2026-09-21T17:17:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:48:44+00:00","updated_at":"2026-10-23T21:48:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:48:44Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade fabio to 1.7.2 or later.\nUntil then, stop backends from trusting the client IP or TLS header values that arrive through fabio, or unset those proxy.header options if they are not needed.","reach":"internet","impact":"medium","summary":"Fabio, a Go HTTP and TCP router for Consul-managed apps, lets an unauthenticated client name and strip the operator-configured trust headers (client IP, TLS, request ID) using the Connection header. Backends that rely on those headers for authorization or audit can be fooled into losing or misreading the real client IP or TLS state.","category":"package","who_cares":["go","fabio","consul","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Backend loses or misreads client IP, TLS or request-ID trust headers, weakening authorization and audit.","analyst_note":"","how_to_check":"Check whether the fabio config sets proxy.header.clientip, proxy.header.tls or proxy.header.requestid to a non-empty value.\nCheck the fabio version with fabio -version; affected range is 1.6.6 up to but not including 1.7.2.\nunknown for a direct curl test command in the sources.","needs_analyst":false,"not_affected_if":["default-config","version-1.7.2-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000563,"input_tokens":3180,"output_tokens":489,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':6A,126C '-2026':25A,33A,36A '-48865':7A,127C '-62987':26A,37A '-6566':34A '/fabiolb/fabio':23A,40A '1.6.6':121C '1.7.2':123C,233C 'addhead':155C 'allow':169C 'app':59B 'applic':116C 'audit':91B,212C 'author':89B,210C 'backend':82B,185C,209C 'call':154C 'client':63B,73B,101B,172C,197C 'client-ip':196C 'clientip/tls/requestid':13A 'clientiphead':146C 'configur':10A,70B,145C,178C 'connect':18A,80B,167C 'consul':41B,57B,119C 'consul-manag':56B 'correl':205C 'correspond':190C 'cve':5A,24A,35A,125C 'default':218C 'deploy':115C,186C 'empti':216C 'enabl':188C 'fabio':1A,42B,48B,106C 'fix':3A,128C,230C 'fool':94B 'forward':138C,223C 'fq95':29A 'ghsa':28A 'ghsa-fq95-v8xc-jm3v':27A 'github.com':22A,39A 'github.com/fabiolb/fabio':21A,38A 'go':32A,43B,50B,162C 'hardcod':135C,221C 'header':12A,19A,72B,81B,87B,139C,160C,168C,179C,224C 'host':47B 'http':51B,109C 'httpproxy.servehttp':153C 'id':77B 'inbound':166C 'incomplet':2A 'ip':74B,102B,198C 'issu':228C 'jm3v':31A 'let':60B 'lose':96B,195C 'manag':58B,117C 'misread':98B 'name':64B,150C,174C 'omit':141C 'oper':9A,69B,144C 'operator-configur':8A,68B,143C 'option':192C,214C 'packag':44B 'process':164C 'protect':222C 'protecthead':132C 'proxy.header':191C 'proxy/http_headers.go':130C 'proxy/http_proxy.go':152C 'reach':183C 'real':100B 'reli':84B 'remov':176C 'request':76B,182C,204C 'request-correl':203C 'requestid':149C 'reverseproxi':163C 'router':54B,113C 'self':46B 'self-host':45B 'set':136C,157C 'signal':206C 'state':105B 'still':14A 'strip':66B 'strippabl':15A 'tcp':53B,112C 'termin':201C 'therefor':194C 'tls':75B,104B,200C 'tls-termin':199C 'tlsheader':147C 'trust':11A,71B,159C 'unaffect':226C 'unauthent':62B,171C 'use':78B,131C,207C 'v8xc':30A 'version':232C 'via':16A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-21T17:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6566","url":"https://pkg.go.dev/vuln/GO-2026-6566","severity":null,"published_at":"2026-10-01T20:23:56+00:00","modified_at":"2026-10-01T20:23:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62987","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62987","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62987","severity":null,"published_at":"2026-09-21T17:17:38+00:00","modified_at":"2026-09-24T21:25:27+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}