CVE-2026-33433: 
NixOS vulnerability analysis and mitigation

CVE-2026-33433 is an authentication bypass vulnerability in Traefik's BasicAuth and DigestAuth middlewares, enabling identity spoofing via non-canonical HTTP header field names. When headerField is configured with a non-canonical name (e.g., x-auth-user instead of X-Auth-User), an authenticated attacker can inject the canonical version of that header to impersonate any identity to the backend. Affected versions include Traefik prior to 2.11.42, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 through 3.7.0-ea.2. The vulnerability was disclosed on March 27, 2026, with a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 5.1 (Medium) (Github Advisory, Traefik Advisory).

The root cause (CWE-290: Authentication Bypass by Spoofing) lies in how Traefik's Go code writes the authenticated username to the request header. In pkg/middlewares/auth/basic_auth.go:92 and digest_auth.go:100, the username is written via direct map assignment (req.Header[b.headerField] = []string{user}), which uses the literal (non-canonical) key provided in configuration. Go's http.Header map is keyed by canonical header names, so a non-canonical write (e.g., x-auth-user) creates a separate map entry rather than overwriting any existing canonical-key entry (X-Auth-User). An attacker who supplies the canonical header in their request occupies the canonical slot, which most backend frameworks read first — effectively overriding Traefik's authentication result. The fix pattern (http.Header.Set() with http.CanonicalHeaderKey()) already existed elsewhere in the codebase (forward.go:254) (Github Advisory, Traefik Advisory).

A successfully exploited attacker with any valid low-privilege credentials can impersonate any other user identity — including administrators — to backend services that rely on the headerField header for authorization decisions, which is the intended and documented use case. This enables full privilege escalation on backend applications, potentially compromising confidentiality (access to sensitive data), integrity (unauthorized data modification), and availability of backend systems. The vulnerability is scoped to subsequent systems (backends behind Traefik), not Traefik itself, and is particularly dangerous in multi-tenant or role-based access control environments (Github Advisory, Traefik Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, demonstrating the attack with a concrete curl command (Traefik Advisory). The vulnerability requires the attacker to have valid credentials (any privilege level) and the target Traefik instance to be configured with a non-canonical headerField value. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.027% (8th percentile), indicating a low near-term exploitation probability (Github Advisory).

1. Reconnaissance: Identify Traefik instances (e.g., via Shodan, Censys, or internal network scanning) running versions prior to 2.11.42 (v2.x), 3.6.12 (v3.6.x), or 3.7.0-ea.3 (v3.7.x).
2. Verify configuration: Confirm that the target Traefik middleware uses basicAuth or digestAuth with a headerField set to a non-canonical header name (e.g., x-auth-user in lowercase YAML configuration).
3. Obtain valid credentials: Acquire any valid low-privilege account credentials for the Traefik-protected service (e.g., admin:admin).
4. Craft the attack request: Send an authenticated HTTP request that includes the canonical version of the configured header set to the target identity:

   curl -u admin:admin -H "X-Auth-User: superadmin" http://traefik/secure/test

5. Achieve identity spoofing: The backend receives two header entries — X-Auth-User: superadmin (attacker-injected, canonical, read first) and x-auth-user: admin (Traefik-set, non-canonical, ignored). The backend authorizes the request as superadmin, granting the attacker elevated privileges (Traefik Advisory, Github Advisory).

• Network: HTTP requests to Traefik-protected endpoints that include both a canonical and non-canonical form of the configured headerField header (e.g., both X-Auth-User and x-auth-user present in the same request).
• Logs: Traefik access logs showing requests where the authenticated username (from BasicAuth/DigestAuth) differs from the value of the headerField header forwarded to the backend; backend application logs showing actions performed under high-privilege identities (e.g., superadmin) from accounts that are only registered as low-privilege users.
• Application Behavior: Unexpected privilege escalation events in backend applications — e.g., a low-privilege user account performing administrative actions — that correlate with requests proxied through Traefik.

Traefik has released patched versions: v2.11.42 (for 2.x), v3.6.12 (for 3.6.x), and v3.7.0-ea.3 (for 3.7.x pre-release) (v2.11.42 Release, v3.7.0-ea.3 Release). Upgrading to a patched version is the recommended remediation. As an interim workaround, operators should ensure that headerField configurations use canonical HTTP header name formats (e.g., X-Auth-User with proper title-case instead of x-auth-user), which prevents the non-canonical map key collision. Additionally, backend services should be configured to strip or reject the headerField header from incoming client requests before it reaches Traefik's auth middleware (Github Advisory).

The Traefik community published a security update announcement covering this and related CVEs for versions 2.11, 3.6, and 3.7 (Traefik Community). IBM issued a security bulletin noting that CVE-2026-33433 affects its watsonx.data product, which bundles Traefik (IBM Advisory). The vulnerability was reported by researcher 0xVijay and credited in the official advisory.