Listen to this Post
The vulnerability resides in Traefik’s ForwardAuth middleware, which delegates authentication to an external service. When `trustForwardHeader` is set to false—a security measure intended to prevent spoofing of `X-Forwarded-` headers—the middleware correctly strips all such headers from the subrequest sent to the auth service. However, a flaw in the reconstruction of the `X-Forwarded-Port` header allows an attacker to bypass this protection.
The issue stems from the `forwardedPort(req)` helper function, which receives the original incoming request (req) rather than the sanitized forward request (forwardReq). This function determines the port to forward by first checking req.Host, then inspecting the `X-Forwarded-Proto` header on the original request. If that header is set to https, the function returns 443—even when the actual connection is plain HTTP.
Consequently, an unauthenticated attacker can send a plain HTTP request with a spoofed `X-Forwarded-Proto: https` header. Traefik forwards this request to the authentication service with `X-Forwarded-Proto: http` (correctly derived from the actual TLS state) but `X-Forwarded-Port: 443` (incorrectly derived from the spoofed header). This inconsistency—Proto=http alongside Port=443—can trick authentication services that base authorization decisions on `X-Forwarded-Port` into granting access to resources that should be restricted to HTTPS connections.
This vulnerability is a regression of the incomplete fix for GHSA-6384-m2mw-rf54 (CVE-2026-35051), which addressed spoofing of `X-Forwarded-Proto` and `X-Forwarded-Prefix` but missed the `X-Forwarded-Port` vector. The issue affects Traefik versions prior to v2.11.51, v3.6.22, and v3.7.6.
A proof-of-concept attack involves a Traefik configuration with the vulnerable middleware and an auth service that grants access when `X-Forwarded-Port` equals 443. An attacker can then execute:
curl -H "X-Forwarded-Proto: https" http://traefik.example.com/api/admin
The auth service receives `X-Forwarded-Port: 443` and incorrectly treats the request as secure, bypassing port-based authorization.
DailyCVE Form:
Platform: Traefik
Version: <2.11.51/<3.6.22/<3.7.6
Vulnerability: Header Spoofing Bypass
Severity: Medium
Date: 2026-07-06
Prediction: Patch 2026-06-30
What Undercode Say:
Traefik static configuration (traefik.yml) middlewares: my-auth: forwardAuth: address: "http://auth-service/" trustForwardHeader: false routers: api: rule: "PathPrefix(<code>/api</code>)" middlewares: - my-auth service: backend
Attacker spoofs X-Forwarded-Proto over plain HTTP curl -H "X-Forwarded-Proto: https" http://traefik.example.com/api/admin Enable Traefik debug logging to observe the forwarded headers traefik --log.level=DEBUG
Example vulnerable auth service logic (Python/Flask)
port = request.headers.get("X-Forwarded-Port", "80")
if port == "443":
return "Access granted", 200
return "Forbidden", 403
Exploit:
- Identify a Traefik instance using ForwardAuth with
trustForwardHeader: false. - Craft a plain HTTP request to a protected route.
3. Inject the `X-Forwarded-Proto: https` header.
- Traefik forwards the request to the auth service with `X-Forwarded-Proto: http` (correct) but `X-Forwarded-Port: 443` (spoofed).
- If the auth service relies on `X-Forwarded-Port` for authorization (e.g., only allowing port 443), the attacker gains unauthorized access.
Protection:
- Upgrade to Traefik v2.11.51, v3.6.22, v3.7.6, or later.
- Avoid basing authorization decisions solely on the `X-Forwarded-Port` header.
- Enforce TLS termination at the edge and validate the actual connection state (e.g.,
req.TLS) rather than relying on forwarded headers.
Impact:
Unauthenticated remote attackers can bypass port-based authentication checks by injecting a single `X-Forwarded-Proto: https` header over a plain HTTP connection. This can lead to privilege escalation in any deployment where the downstream authentication service uses `X-Forwarded-Port` to determine whether a request originates from a secure (HTTPS) port. The vulnerability affects all Traefik versions prior to the patched releases and is particularly dangerous in environments where administrative interfaces or sensitive APIs are protected by port-based rules.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
