THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-rf44-j88r-hh8c (medium) — Traefik: ForwardAuth identity spoofing via dot-form header alias

[GHSA] GHSA-rf44-j88r-hh8c (medium) — Traefik: ForwardAuth identity spoofing via dot-form header alias

medgithub_advisoriesPublished 2026-09-10

GHSA-rf44-j88r-hh8c Severity: medium CVE: CVE-2026-88011

Traefik: ForwardAuth identity spoofing via dot-form header alias

## Summary

There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so `X-Auth-User`, `X_Auth_User` and `X.Auth.User` are three distinct headers to Traefik, while b

Indicators of compromise

CVE-2026-88011cve

Original source: https://github.com/advisories/GHSA-rf44-j88r-hh8c