Traefik is affected by a header canonicalization vulnerability (CVE-2026-88879) in versions v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11. The vulnerability arises because Traefik only canonicalizes header names on dashes, treating headers like X-Auth-User, X_Auth_User, and X.Auth.User as distinct. Backend systems that collapse these variants into a single variable can be tricked by an attacker supplying a dot-form alias header, bypassing Traefik's middleware protections such as ForwardAuth. This can cause the backend to trust attacker-controlled header values, potentially leading to unauthorized access or privilege escalation. The issue is an incomplete fix of a prior vulnerability (GHSA-x677-9fxg-v5c5) that only addressed underscore forms. The fix is available in Traefik v2.11.56 and v3.7.12, which introduce the aliasHeadersStrategy option. However, this option defaults to 'keep' for backward compatibility and must be explicitly set to 'delete' or 'reject' to mitigate the issue. Unmaintained release lines will not be patched.

An attacker can bypass Traefik's middleware header protections by sending specially crafted headers with dot-form aliases, causing backend services to accept attacker-controlled header values instead of those set by Traefik. This can lead to privilege escalation or identity spoofing, allowing unauthorized access or actions within the backend application. The vulnerability affects all headers set by Traefik, not just those related to authentication middleware.

A fix is available in Traefik versions v2.11.56 and v3.7.12. To fully mitigate the vulnerability, administrators must explicitly configure the aliasHeadersStrategy entry-point option to 'delete' or 'reject' to prevent dot-form header aliases from bypassing middleware protections. Unmaintained versions will not receive patches, so upgrading to a maintained version and applying the configuration change is recommended.