Threats tagged 'ghsa-qr99-7898-vr7c'

Traefik's Basic and Digest authentication middlewares are vulnerable to identity spoofing when the 'headerField' is configured with a non-canonical HTTP header name. An authenticated attacker with valid credentials can inject a canonical header version to impersonate any user identity to backend services. This occurs because Traefik writes the authenticated username using a non-canonical header key, creating a separate header entry that does not overwrite the attacker-injected canonical header. The vulnerability enables privilege escalation if backends rely on this header for authorization decisions. Patches fixing this issue are available in Traefik versions 2.11.42, 3.6.12, and 3.7.0-ea.3.