CVE-2026-26998: 
NixOS vulnerability analysis and mitigation

CVE-2026-26998 is a Denial of Service vulnerability in Traefik's ForwardAuth middleware caused by unbounded memory allocation when reading authentication server response bodies. Discovered and disclosed on March 4, 2026, it affects Traefik v2.x up to and including v2.11.37 and v3.x up to and including v3.6.8. The vulnerability was reported by security researcher sm1ee and published by Traefik maintainer emilevauge. It carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). In pkg/middlewares/auth/forward.go at line 213, the ForwardAuth middleware calls io.ReadAll(forwardResponse.Body) on the authentication server's HTTP response without any size constraint, allowing unbounded memory allocation. Notably, Traefik already implements a maxBodySize guard with a warning log for the request body direction (forward.go:85-95), but the response body path has no equivalent protection. Although the HTTP client enforces a 30-second timeout, a chunked streaming response can deliver hundreds of megabytes per second within that window, making the timeout an insufficient safeguard. A public proof-of-concept is included in the advisory, demonstrating a malicious Python auth server that streams infinite chunked data (GitHub Advisory).

Successful exploitation results in complete denial of service for all routes served by the affected Traefik instance. A single malicious HTTP request can cause Traefik to allocate gigabytes of memory — observed growing from 98 MiB to 1.43 GiB in testing — until the process is killed by the OS OOM killer (exit code 137/SIGKILL), rendering all proxied services unreachable. There is no confidentiality or integrity impact; the vulnerability is purely an availability concern. High-risk scenarios include multi-tenant platforms (SaaS, PaaS, Kubernetes ingress controllers) where tenants control their own ForwardAuth endpoints, as well as environments with compromised or buggy authentication servers (GitHub Advisory).

A public proof-of-concept is included in the official security advisory, consisting of a simple Python HTTP server that streams infinite chunked data to trigger OOM. Exploitation requires high privileges (control over or ability to influence the ForwardAuth authentication server endpoint) and high attack complexity, limiting the realistic attacker pool. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of exploitation in the wild within 30 days. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Identify target: Confirm the target Traefik instance is using the ForwardAuth middleware and that the attacker controls or can compromise the configured authentication server endpoint.
2. Deploy malicious auth server: Stand up a server that responds to auth requests with an infinite chunked HTTP response, e.g., using the published PoC Python script (auth_infinite.py) that continuously streams 64 KiB chunks with Transfer-Encoding: chunked.
3. Configure or redirect ForwardAuth: Ensure the Traefik ForwardAuth middleware is pointed at the malicious auth server (e.g., address: "http://malicious-auth:9000/auth" in dynamic.yml).
4. Trigger the vulnerability: Send a single HTTP request to any route protected by the ForwardAuth middleware (e.g., curl http://traefik-host:8000/admin). Traefik will forward the auth check to the malicious server and call io.ReadAll() on the infinite response body.
5. OOM crash achieved: Traefik's memory grows unboundedly until the OS OOM killer terminates the process (exit code 137), causing a complete service outage for all routes on the affected entrypoint (GitHub Advisory).

• Process: Traefik process memory usage growing rapidly and continuously (observable via docker stats or system monitoring tools); Traefik process terminating with exit code 137 (SIGKILL/OOM kill).
• Logs: Container or system OOM killer log entries referencing the Traefik process; docker inspect <traefik_container> --format '{{.State.OOMKilled}}' returning true.
• Network: Sustained, long-lived HTTP connections from Traefik to the ForwardAuth authentication server endpoint with large or continuously growing data transfer; absence of a Content-Length header and presence of Transfer-Encoding: chunked in auth server responses.
• Availability: All routes on the affected Traefik entrypoint becoming unreachable immediately following the OOM kill event (GitHub Advisory).

Traefik has released patched versions v2.11.38 and v3.6.9, which add a maxResponseBodySize configuration option to the ForwardAuth middleware, mirroring the existing maxBodySize protection for request bodies. The fix applies io.LimitReader to the auth server response body before calling io.ReadAll. No workaround is available for unpatched versions — the vendor explicitly states there is no configuration-based mitigation. Operators should upgrade to v2.11.38 or v3.6.9 immediately (Traefik v2.11.38 Release, Traefik v3.6.9 Release).

The Traefik community forum published a security update announcement covering this and two other CVEs fixed in the same release (Traefik Community). Red Hat tracked the issue via Bugzilla with medium severity, and openSUSE issued security announcements for their packaged versions of Traefik (Red Hat Bugzilla). No significant broader media coverage or notable researcher commentary beyond the original reporter (sm1ee) has been identified.