CVE-2026-39858: 
NixOS vulnerability analysis and mitigation

CVE-2026-39858 is a high-severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware, dubbed "Forwarded Alias Spoofing to Pre-Auth Decision Bypass." It affects all Traefik v2.x versions prior to 2.11.43, v3.x versions from 3.0.0 up to (but not including) 3.6.14, and v3.7.0 early access/RC builds prior to 3.7.0-rc.2; Traefik v1.x (≤1.7.34) is also listed as affected with no patch available for that branch. The vulnerability was published on April 24, 2026, with NVD publication on April 30, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) and a CVSS v4.0 base score of 7.8 (High) (GitHub Advisory, Traefik Advisory).

The root cause is an incomplete forwarded-header sanitization logic (CWE-290: Authentication Bypass by Spoofing; CWE-306: Missing Authentication for Critical Function) that creates a trust boundary mismatch between Traefik's ingress processing and its auth subrequest construction. Traefik's sanitization logic in pkg/middlewares/forwardedheaders/forwarded_header.go only targets canonical dash-delimited header names (e.g., X-Forwarded-Proto, X-Forwarded-Host) and ignores underscore-delimited alias variants (e.g., X_Forwarded_Proto). During ForwardAuth and snippet-based auth processing, headers are copied wholesale to the auth subrequest via utils.CopyHeaders() with filtering limited only to hop-by-hop headers — meaning attacker-supplied alias headers pass through unmodified. When the downstream authentication backend normalizes underscore and dash forms equivalently, an attacker's injected alias headers satisfy trust predicates (e.g., scheme = HTTPS, trusted host), bypassing authentication entirely without valid credentials (Traefik Advisory, GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to bypass ForwardAuth and snippet-based authentication middleware, gaining access to protected routes and backend services as if fully authenticated. The primary impact is on confidentiality and integrity of downstream (subsequent) systems — attackers can access sensitive internal functionality, read protected data, and perform unauthorized actions against backend services. In environments where authorization decisions are driven by forwarded headers (e.g., scheme enforcement, trusted host checks), the entire authentication boundary is effectively nullified, potentially enabling lateral movement to internal services behind the proxy (GitHub Advisory, Traefik Advisory).

A proof-of-concept (PoC) exploit is publicly available in the official Traefik security advisory, which includes concrete HTTP requests demonstrating the exact payload structure needed to bypass authentication (Traefik Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges — only network access to a vulnerable Traefik instance with ForwardAuth or snippet-based auth configured against a normalizing backend. The EPSS score is approximately 0.028% (0.000280), indicating currently low predicted exploitation probability. As of the time of reporting, there is no evidence of active in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. Nessus detection plugin 311474 is available (Feedly).

1. Reconnaissance: Identify internet-facing Traefik instances running vulnerable versions (v2.x < 2.11.43, v3.0.0–3.6.13, or v3.7.0-ea1 through v3.7.0-rc.1) using tools like Shodan or Censys, looking for Traefik-specific response headers or dashboard endpoints.
2. Identify protected routes: Probe the target to identify routes protected by ForwardAuth or snippet-based authentication middleware (e.g., routes returning 401/403 with auth-related headers).
3. Confirm backend normalization: Determine whether the authentication backend normalizes underscore and dash header variants equivalently (common in many frameworks such as Python/WSGI, some Go HTTP libraries, and nginx-based auth services).
4. Craft exploit request: Construct an HTTP request to the protected route that includes underscore-variant forwarded headers with spoofed trusted values:

GET /protected HTTP/1.1
Host: app.example.local
X_Forwarded_Proto: https
X_Forwarded_Host: trusted.example
Connection: close

5. Bypass authentication: Traefik forwards the alias headers intact to the auth backend; the backend normalizes X_Forwarded_Proto to X-Forwarded-Proto and evaluates the spoofed trust context (e.g., scheme = https, host = trusted.example), granting access without valid credentials.
6. Access protected resources: With authentication bypassed, interact with the protected backend service as an authenticated user, potentially exfiltrating data or performing privileged operations (Traefik Advisory, GitHub Advisory).

• Network: HTTP requests to protected routes containing underscore-variant forwarded headers (X_Forwarded_Proto, X_Forwarded_Host, X_Forwarded_For) in the raw request; successful 200 responses to routes that should return 401/403 for unauthenticated clients.
• Logs: Traefik access logs showing requests to ForwardAuth-protected endpoints with unusual or unexpected header combinations resulting in successful authentication; auth backend logs showing requests with both canonical (X-Forwarded-*) and alias (X_Forwarded_*) header forms in the same subrequest.
• Network: Unexpected outbound subrequests from Traefik to the ForwardAuth backend originating from client IPs that lack valid session tokens or credentials.
• Logs: Auth service logs showing trust predicates (e.g., scheme=https, host=trusted.example) being satisfied by requests that do not originate from trusted upstream proxies (Traefik Advisory).

Traefik has released patched versions that remove untrusted X headers with underscores at the middleware layer (commit fix: [middleware] Remove untrusted X headers with underscores). Users should upgrade to v2.11.43 (for 2.x branch), v3.6.14 (for 3.6.x branch), or v3.7.0-rc.2 or later (for 3.7.x branch) immediately (v2.11.43 Release, v3.6.14 Release, v3.7.0-rc.2 Release). As a configuration-based workaround prior to patching, operators should configure auth backends to reject or ignore underscore-variant forwarded headers, or implement explicit allowlists of forwarded headers at the auth service level. Note that Traefik v1.x (≤1.7.34) has no available patch and users should migrate to a supported version. The advisory also recommends deprecating the ForwardAuth.TrustForwardHeader option, which was addressed in the patched releases (Traefik Advisory).

Traefik published an official community forum post announcing the security updates for versions 2.11.43, 3.6.14, and 3.7.0-rc.2, providing guidance to users on upgrading (Traefik Community). The vulnerability was reported by researcher "fancymalware" and received coverage from security aggregators including VulDB and infinitsec.net shortly after disclosure. Tenable released Nessus detection plugin 311474 for the vulnerability, and openSUSE issued a security announcement covering the affected package (Feedly).