https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:27:08.317018+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0823 certfr-2026-avi-0823 — De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer un contourne… 2026-10-03T11:27:08.320888+00:00 certfr-2026-avi-0823 https://cve.radiocsirt.org/vuln/euvd-2026-333665 EUVD-2026-333665 2026-10-03T11:27:08.320931+00:00 EUVD-2026-333665 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54764 fkie_cve-2026-54764 2026-10-03T11:27:08.320945+00:00

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.

 https://cve.radiocsirt.org/vuln/ghsa-3q9r-p662-5j8m GHSA-3q9r-p662-5j8m — Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader… 2026-10-03T11:27:08.320978+00:00

Affected: Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik/v3, Go: github.com/traefik/traefik

## Summary

There is a medium severity vulnerability in Traefik's ForwardAuth middleware. Even when configured with `trustForwardHeader: false`, Traefik derives the `X-Forwarded-Port` header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an `X-Forwarded-Proto: https` header over a plain HTTP connection and cause Traefik to forward `X-Forwarded-Port: 443` to the auth service, bypassing port-based authorization checks. This is a regression of the incomplete fix for GHSA-6384-m2mw-rf54, which addressed the `X-Forwarded-Proto` and `X-Forwarded-Prefix` spoofing vectors but missed the `X-Forwarded-Port` vector.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.51 - https://github.com/traefik/traefik/releases/tag/v3.6.22 - https://github.com/traefik/traefik/releases/tag/v3.7.6

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

<details> <summary>Original Description</summary>

### Summary

The ForwardAuth middleware, even when configured with `trustForwardHeader: false`, still derives the `X-Forwarded-Port` header sent to the authentication service by reading the **attacker-controlled** `X-Forwarded-Proto` header from the original incoming request. This allows an unauthenticated remote attacker to cause Traefik to forward `X-Forw…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11243-1 openSUSE-SU-2026:11243-1 — traefik2-2.11.52-1.1 on GA media 2026-10-03T11:27:08.321045+00:00

traefik2-2.11.52-1.1 on GA media