CVE-2026-88011: 
NixOS vulnerability analysis and mitigation

CVE-2026-88011 is a ForwardAuth identity spoofing vulnerability in Traefik, an open-source HTTP reverse proxy and load balancer, classified as Authentication Bypass by Spoofing (CWE-290). It affects all Traefik versions prior to 2.11.56 and versions 3.0.0 through 3.7.11. The flaw allows a low-privileged client to supply a dot-form HTTP header alias (e.g., X.Authenticated.User) that bypasses Traefik's ForwardAuth middleware and underscoreHeadersStrategy protection, enabling identity spoofing against normalization-prone backends. It was disclosed on September 10, 2026, with patches released on August 26, 2026. The CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is that Go's HTTP library canonicalizes header names only on dashes, treating X-Authenticated-User, X_Authenticated-User, and X.Authenticated.User as three distinct headers. However, normalization-prone backends (CGI, WSGI, PHP, NGINX) uppercase header names and replace every non-alphanumeric, non-dash character with an underscore, collapsing all three into the same variable (e.g., HTTP_X_AUTHENTICATED_USER). Traefik's ForwardAuth middleware deletes and replaces only the canonical dash-form header after authentication, leaving dot-form aliases untouched in req.Header. Go's HTTP/1 writer serializes headers lexically, placing X-Authenticated-User before X.Authenticated.User, so the backend reads the client-supplied dot-form value last and it deterministically overrides the identity asserted by Traefik. This is an incomplete-fix sibling of GHSA-x677-9fxg-v5c5, which only blocked underscore-form aliases. A proof-of-concept (Docker Compose-based) was included in the original advisory report (GitHub Advisory, Fix PR).

A low-privileged client who is permitted by ForwardAuth (i.e., not denied) can impersonate another user or administrative role by injecting a dot-form alias of any header Traefik manages, not limited to ForwardAuth's identity header. This affects confidentiality and integrity of backend systems that rely on Traefik-asserted identity headers for authorization decisions. The vulnerability was runtime-verified against PHP 8.2 backends; impact on other normalization-prone backends (CGI, WSGI, NGINX) is conditional on their header normalization behavior. Availability is not directly impacted (GitHub Advisory).

A Docker Compose-based proof-of-concept was included in the original vulnerability report submitted to the Traefik maintainers, demonstrating deterministic identity override on Traefik v3.7.10 with PHP 8.2. There is no evidence of public exploit code release or active in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to already be permitted by the ForwardAuth service (i.e., authenticated as a lower-privilege identity) and the backend must be a normalization-prone runtime (GitHub Advisory, Feedly).

1. Identify target: Locate a Traefik instance (v1.x, < 2.11.56, or 3.0.0–3.7.11) fronting a normalization-prone backend (PHP, CGI, WSGI, NGINX) with ForwardAuth middleware configured and aliasHeadersStrategy not set to delete or reject.
2. Obtain low-privilege access: Authenticate as a low-privilege user that ForwardAuth permits — the exploit does not bypass ForwardAuth denial, only identity assertion after a permitted request.
3. Craft malicious request: Send an HTTP request to the protected endpoint including both the normal request and a dot-form alias of the identity header Traefik manages, e.g.:

GET /probe HTTP/1.1
Host: 127.0.0.1:18080
X.Authenticated.User: admin
Connection: close

4. Header survives middleware: Traefik's ForwardAuth middleware removes and replaces only the canonical X-Authenticated-User header with the value returned by the auth service (e.g., lab-user), but the client-supplied X.Authenticated.User: admin remains in the forwarded request.
5. Backend collapses aliases: The PHP (or other normalization-prone) backend maps both X-Authenticated-User and X.Authenticated.User to the same HTTP_X_AUTHENTICATED_USER server variable; Go's HTTP/1 writer serializes X.Authenticated.User last, so the backend reads admin instead of lab-user.
6. Achieve privilege escalation: The backend grants the attacker access as the spoofed identity (e.g., admin), bypassing role-based access controls that rely on the Traefik-asserted header (GitHub Advisory).

• Network: HTTP requests to ForwardAuth-protected endpoints containing headers with dot-form names (e.g., X.Authenticated.User, X.Auth.User) alongside their canonical dash-form equivalents; unexpected privilege escalation patterns in access logs where a low-privilege user accesses admin-only resources.
• Logs: Traefik access logs showing requests with non-standard header names containing dots, exclamation marks, or other non-alphanumeric, non-dash characters; backend application logs showing admin-level actions attributed to accounts that should only have lower privileges.
• Application Behavior: Backend audit logs recording actions by high-privilege identities (e.g., admin) from sessions that were authenticated as lower-privilege users; authorization decisions inconsistent with the ForwardAuth-returned identity.

Upgrade Traefik to version 2.11.56 (v2 branch) or 3.7.12 (v3 branch), which introduce the new aliasHeadersStrategy entry point option (v2.11.56 Release, v3.7.12 Release). After upgrading, explicitly configure aliasHeadersStrategy to delete or reject on all entry points fronting normalization-prone backends — the default value is keep, which preserves the vulnerable behavior for backwards compatibility:

entryPoints:
  websecure:
    address: ':443'
    http:
      aliasHeadersStrategy: delete

The deprecated underscoreHeadersStrategy option only mitigated underscore-form aliases and should be replaced with aliasHeadersStrategy. Traefik v1.x and unmaintained v2/v3 lines will not receive backported patches; users on those versions must upgrade (GitHub Advisory).

The Traefik maintainers published the advisory (GHSA-rf44-j88r-hh8c) and released patches on August 26, 2026, framing the issue as an incomplete fix for the previously disclosed GHSA-x677-9fxg-v5c5 (underscore header spoofing). The fix PR (#13720) received prompt review and approval from multiple core maintainers, and the release notes explicitly called out the CVE fix. The NixOS security tracker opened a tracking issue for backporting the fix to stable channels shortly after disclosure (GitHub Advisory, Fix PR).