CVE-2026-29054: 
NixOS vulnerability analysis and mitigation

CVE-2026-29054 is a case-sensitivity bypass vulnerability in Traefik's XForwarded middleware (removeConnectionHeaders) that allows unauthenticated remote attackers to strip Traefik-managed forwarded identity headers (e.g., X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port) by supplying lowercase Connection header tokens. It affects Traefik v2.11.9–v2.11.37 and v3.1.3–v3.6.8, and is a bypass of the previously issued fix for CVE-2024-45410. Disclosed on March 4, 2026 via the GitHub Advisory Database, it carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Traefik Advisory).

The root cause (CWE-178: Improper Handling of Case Sensitivity) lies in the removeConnectionHeaders function in pkg/middlewares/forwardedheaders/forwarded_header.go (line 225). The function uses a case-sensitive slices.Contains check to determine whether a Connection token matches a protected header name, but Go's net/http library performs header deletion case-insensitively. An attacker can send Connection: x-real-ip (lowercase), which bypasses the case-sensitive protection check while still causing net/http to delete the Traefik-managed X-Real-Ip header. No authentication or special privileges are required; the attack is conducted over the network via a standard HTTP/1.1 request. A proof-of-concept (poc.zip) was included with the advisory demonstrating end-to-end access control bypass (Traefik Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to cause Traefik to strip its own managed forwarded identity headers before passing requests to downstream services. If downstream services rely on headers such as X-Real-Ip or X-Forwarded-* for authentication, authorization, IP allowlisting, routing, or scheme decisions, those controls can be bypassed or misdirected — potentially enabling unauthorized access to protected resources. There is no direct confidentiality or availability impact, but the integrity impact is rated High due to the potential for authentication and authorization bypass in dependent services (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept was included in the original advisory submission, demonstrating a deterministic end-to-end access control bypass. No exploit kits or in-the-wild exploitation have been reported as of the time of disclosure. The EPSS score is approximately 0.009% (0.000090), placing it in the 3rd percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no user interaction, and has low complexity, making it straightforward to exploit in deployments where downstream services trust Traefik-managed headers (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Traefik reverse proxy instances running versions v2.11.9–v2.11.37 or v3.1.3–v3.6.8 using tools like Shodan or Censys, or by inspecting HTTP response headers (e.g., Server: Traefik).
2. Identify target headers: Determine which Traefik-managed forwarded headers (e.g., X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port) are used by downstream services for authentication, authorization, or routing decisions.
3. Craft malicious HTTP/1.1 request: Construct an HTTP/1.1 request with a lowercase Connection header token referencing the target header, e.g., Connection: x-real-ip.
4. Send request to Traefik: Transmit the crafted request to the Traefik proxy endpoint. Traefik's case-sensitive protection check fails to recognize the lowercase token as a protected header, but net/http deletes X-Real-Ip case-insensitively.
5. Downstream bypass: The downstream service receives the request without the expected Traefik-managed identity header (e.g., X-Real-Ip is absent), causing IP allowlist checks, authentication, or routing logic to fail open or be bypassed, granting unauthorized access (Traefik Advisory, GitHub Advisory).

• Network: HTTP/1.1 requests to Traefik with Connection header values containing lowercase versions of protected header names (e.g., Connection: x-real-ip, Connection: x-forwarded-host, Connection: x-forwarded-port).
• Logs: Traefik access logs showing requests where Connection header tokens match (case-insensitively) protected forwarded header names; downstream service logs showing requests arriving without expected X-Real-Ip or X-Forwarded-* headers that Traefik should have set.
• Application Behavior: Downstream services logging authorization decisions made without the expected identity headers; unexpected access grants from requests that should have been blocked by IP allowlists or header-based authentication controls.

Traefik has released patched versions v2.11.38 (for the v2 branch) and v3.6.9 (for the v3 branch), which fix the case-sensitivity issue by canonicalizing Connection header tokens before comparing them against protected header names. No configuration-based workaround is available — upgrading to a patched version is the only remediation. Organizations should prioritize upgrading any Traefik instance where downstream services rely on X-Real-Ip or X-Forwarded-* headers for security decisions (Traefik v2.11.38 Release, Traefik v3.6.9 Release, Traefik Advisory).

The Traefik maintainer (emilevauge) published the advisory on March 4, 2026, and the Traefik community forum posted a security update announcement covering both the v2 and v3 patch releases (Traefik Community). Red Hat opened a Bugzilla tracking entry (Bug 2444872) with high severity, indicating downstream distribution impact (Red Hat Bugzilla). OpenSUSE also issued a security announcement for the affected Traefik package. The vulnerability was reported by researcher 1seal, who provided a detailed PoC demonstrating an end-to-end access control bypass pattern.