CVE-2026-62987: 
Consul vulnerability analysis and mitigation

CVE-2026-62987 is an incomplete fix vulnerability in Fabio, an HTTP(S) and TCP router for Consul-managed deployments, that allows unauthenticated attackers to strip operator-configured trust headers via HTTP Connection header manipulation. It affects Fabio versions >= 1.6.6 through 1.7.1 and was published on July 3, 2026, with the CVE assigned on September 21, 2026. The flaw is a bypass of the prior CVE-2025-48865 fix, which only protected a hardcoded set of forwarded headers while leaving operator-configured ClientIPHeader, TLSHeader, and RequestID headers unprotected. It carries a CVSS v3.1 base score of 5.8 (Medium) (GitHub Advisory).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing) and CWE-348 (Use of Less Trusted Source). The fix for CVE-2025-48865 introduced a protectHeaders allowlist in proxy/http_headers.go (lines 28–36) containing only seven hardcoded X-Forwarded-family headers; however, the three operator-configured trust headers (ClientIPHeader, TLSHeader, RequestID) were never added to this allowlist. In HTTPProxy.ServeHTTP (http_proxy.go), the addHeaders function sets these trust headers server-side, but Go's httputil.ReverseProxy subsequently processes the inbound Connection header and calls removeHopByHopHeaders, which deletes any header name listed in the Connection header — including the trust headers Fabio just set, since they are absent from protectHeaders. A proof-of-concept raw HTTP request demonstrating the attack is included in the official advisory (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to strip or nullify client-IP, TLS-termination, or request-correlation signals that backend services rely on for authorization decisions and audit logging. Backends trusting the ClientIPHeader may have their IP-based access control lists (ACLs) bypassed or poisoned; backends keying off the TLSHeader may be deceived into treating a TLS-terminated request as non-TLS; and request-ID correlation used for audit trails can be dropped entirely. The vulnerability only affects deployments that have explicitly configured one or more of the proxy.header.clientip, proxy.header.tls, or proxy.header.requestid options (all are empty by default), and it does not directly expose confidential data or cause availability loss (GitHub Advisory).

A proof-of-concept exploit is publicly available in the official GitHub Security Advisory, consisting of a crafted raw HTTP request that demonstrates header stripping against a real Fabio deployment. The exploit requires no authentication, no user interaction, and is fully automatable over the network. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.162% (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify Fabio instances (versions 1.6.6–1.7.1) exposed over the network, and determine whether the deployment has configured any of proxy.header.clientip, proxy.header.tls, or proxy.header.requestid to non-empty values (e.g., X-Client-IP, X-Request-ID, X-Secure).
2. Craft malicious HTTP request: Construct an HTTP request that includes a Connection header listing the names of the operator-configured trust headers alongside standard connection tokens:

GET / HTTP/1.1
Host: foo.com
Connection: close, X-Client-IP, X-Request-ID

3. Send request to Fabio: Transmit the crafted request to the Fabio proxy endpoint. Fabio's addHeaders function sets the trust headers server-side (e.g., X-Client-IP to the real remote IP, X-Request-ID to a generated UUID).
4. Trigger hop-by-hop removal: Go's httputil.ReverseProxy processes the inbound Connection header and calls removeHopByHopHeaders, deleting every header name listed — including X-Client-IP and X-Request-ID — because they are absent from the protectHeaders allowlist.
5. Backend receives stripped request: The backend sees empty or missing trust headers (e.g., X-Client-IP: <empty>, X-Request-ID: <empty>), potentially bypassing IP-based ACLs, corrupting audit logs, or causing TLS-state misidentification (GitHub Advisory).

• Network: Inbound HTTP requests to Fabio with a Connection header that lists non-standard header names matching the configured proxy.header.clientip, proxy.header.tls, or proxy.header.requestid values (e.g., Connection: close, X-Client-IP, X-Request-ID).
• Logs: Fabio access logs showing requests where the backend received empty or absent trust headers despite the proxy being configured to inject them; discrepancies between Fabio-side and backend-side header values in correlated log entries.
• Application Behavior: Backend authorization decisions that appear to grant access from unexpected IP ranges, or audit records missing request-correlation IDs, may indicate trust header stripping is occurring (GitHub Advisory).

Upgrade Fabio to version 1.7.2, which resolves the issue by dynamically adding the operator-configured ClientIPHeader, TLSHeader, and RequestID names to the protectHeaders set at startup (commit 240526a) (Fabio v1.7.2 Release, Fix Commit). If immediate patching is not possible, disable the affected proxy header options (proxy.header.clientip, proxy.header.tls, proxy.header.requestid) by leaving them empty (their default state), which eliminates the attack surface entirely. Deployments that cannot disable these options should restrict network access to the Fabio proxy to trusted clients only as a temporary compensating control (GitHub Advisory).

The vulnerability was reported by researcher thientd and published by Fabio maintainer tristanmorgan via the GitHub Security Advisory program on July 3, 2026. A Mastodon post referencing the issue was observed in late 2026, indicating some community awareness. No major media coverage or significant vendor statements beyond the official advisory have been identified (GitHub Advisory).