Insufficient verification of data authenticity in Traefik - CVE-2024-45410
Published: September 19, 2024 / Updated: May 5, 2026
Traefik
Containous
Description
The vulnerability allows a remote attacker to bypass security controls by removing or manipulating trusted forwarded headers.
The vulnerability exists due to insufficient verification of data authenticity in Traefik HTTP header handling when processing HTTP/1.1 requests with hop-by-hop headers declared through the Connection header. A remote attacker can send a specially crafted request to bypass security controls by removing or manipulating trusted forwarded headers.
Some backend frameworks may treat underscore and hyphen variants of forwarded header names equivalently, which can allow attacker-supplied replacement values to be used. Client certificate-related forwarded headers are also affected when client certificate authentication is enabled.