Authentication Bypass by Spoofing in Traefik - CVE-2026-39858

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass authentication and access protected endpoints.

The vulnerability exists due to authentication bypass by spoofing in ForwardAuth and snippet-based authentication middleware when forwarding client-supplied alias forwarded headers to the authentication backend. A remote attacker can send a specially crafted request with spoofed forwarded-header aliases to bypass authentication and access protected endpoints.

Exploitation requires an authentication backend that normalizes underscore and dash header forms equivalently.

How to mitigate CVE-2026-39858

Sources

• https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm
• https://github.com/traefik/traefik/blob/174e5d81111d8e9fb3d3c81cf6d22f3e33eb4f78/pkg/middlewares/auth/forward.go#L401-L408