Listen to this Post
CVE-2026-29054 is a security bypass vulnerability in the Traefik reverse proxy, affecting versions from 2.11.9 to 2.11.37 and 3.1.3 to 3.6.8 . It stems from a case-handling mismatch in how Traefik protects its internally managed `X-Forwarded-` headers (like X-Real-Ip) from being deleted by client requests . After a previous fix (for CVE-2024-45410), Traefik implemented a protection mechanism that compares tokens in the incoming `Connection` header against a list of protected header names to prevent their removal . However, this comparison is performed in a case-sensitive manner, while the subsequent deletion of headers by the underlying HTTP engine is case-insensitive . A remote, unauthenticated attacker can exploit this discrepancy by sending a request with a lowercase `Connection` token, such as Connection: x-real-ip. Because the protection check looks for `X-Real-Ip` (uppercase) and fails to match the lowercase token, it incorrectly allows the request to proceed. The case-insensitive deletion process then removes the legitimate `X-Real-Ip` header added by Traefik . This can lead to severe consequences if downstream services rely on these headers for security functions like IP allowlisting, authentication, or routing decisions, effectively allowing an attacker to bypass these controls .
Platform: Traefik
Version: 2.11.9-2.11.37, 3.1.3-3.6.8
Vulnerability: Case-sensitivity bypass
Severity: High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Date: 03/05/2026
Prediction: Patched 03/05/2026
What Undercode Say
Analysis
This vulnerability (CVE-2026-29054) is a classic example of an incomplete fix leading to a bypass . The core issue is an inconsistency in string handling: a case-sensitive blocklist vs. a case-insensitive operation. Its criticality is high because it undermines trust in proxy-derived identity, which is often the foundation of security in zero-trust and microservices architectures .
Exploit
An attacker can exploit this with a simple `curl` command. The following example attempts to remove the `X-Real-Ip` header added by Traefik before it reaches the backend service.
Exploit: Send a request with a lowercase Connection token to delete the X-Real-Ip header curl -H "Host: vulnerable-app.internal" \ -H "Connection: x-real-ip" \ http://<traefik-ip>:<port>/
Protection
The primary protection is to upgrade to the patched versions. For comprehensive detection and prevention, the following steps are recommended:
1. Immediate Upgrade: Update Traefik to version 2.11.38 or 3.6.9 or later .
2. Detect with Nuclei: Use a custom Nuclei template to scan for the vulnerability.
id: CVE-2026-29054
info:
name: Traefik X-Forwarded-Headers Bypass
severity: high
requests:
- method: GET
path:
- "{{BaseURL}}"
headers:
Connection: x-real-ip
matchers:
- type: word
part: header
words:
- "X-Real-Ip"
condition: absent
3. Monitor Logs: Check Traefik access logs for unusual `Connection` headers with lowercase `x-forwarded-` or `x-real-ip` tokens. This could indicate active scanning or exploitation attempts.
Impact
A successful exploit allows a remote unauthenticated attacker to strip trusted headers added by the proxy . The direct impact is a High integrity compromise, as backend applications will make decisions based on incomplete or incorrect information . This can lead to:
IP Allowlist Bypass: If a backend relies on `X-Real-Ip` for access control, removing it may cause the request to be processed as if it came from a trusted source .
Routing Manipulation: Headers like `X-Forwarded-Host` are used for virtual hosting; removing them could route requests to the wrong application.
Authentication Bypass: If authentication relies on proxy-provided headers (e.g., client certificates via X-Forwarded-Tls-Client-Cert-Info), their removal could allow unauthenticated access .
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow DailyCVE & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin
Traefik, TLS Handshake DoS, CVE-2026-26999 (High)