THREAT OPS › Threat News › [GHSA] GHSA-v67p-phpq-fc8x (high) — Traefik entrypoint header-name sanitization bypassed via request trailers
[GHSA] GHSA-v67p-phpq-fc8x (high) — Traefik entrypoint header-name sanitization bypassed via request trailers
GHSA-v67p-phpq-fc8x Severity: high CVE: CVE-2026-88004
Traefik entrypoint header-name sanitization bypassed via request trailers
## Summary
Traefik's entrypoint defenses against spoofed trusted header names — `aliasHeadersStrategy` / `underscoreHeadersStrategy` in `delete` or `reject` mode, and the default `forwardedHeaders` stripping of client-supplied `X-Forwarded-*` — scan `req.Header` only
Indicators of compromise
- CVE-2026-88004cve
- CVE-2026-63379cve
- CVE-2026-54763cve
- CVE-2026-73495cve
- CVE-2026-33433cve
- CVE-2026-39858cve
- http://`url
- http://127.0.0.1:8083url
- 203.0.113.7ipv4
Original source: https://github.com/advisories/GHSA-v67p-phpq-fc8x