5.1
Medium
CVE-2026-33433 Traefik is an HTTP reverse proxy and load balancer
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| traefik 3.7 | 3.7.0-ea.1 → < 3.7.0-ea.3 | 3.7.0-ea.3 |
| traefik 3.0 | 3.0.0-beta1 → < 3.6.11 | 3.6.11 |
| traefik 2.11 | earliest → < 2.11.42 | 2.11.42 |
| Red Hat OpenShift Dev Spaces 3.27 1776718585 | earliest → < 1776718585 | 1776718585 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of traefik
The 80 CVEs of traefik →
CVE-2026-121966
Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
7.0
High
CVE-2026-119574
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated…
8.2
High
CVE-2026-119573
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the…
2.1
Low
CVE-2026-119572
Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
7.0
High