Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-04-30T20:26:06 Traefik: github.com/traefik/traefik: Traefik: Authentication bypass in ForwardAuth middleware 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CWE-501

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This authentication bypass vulnerability exists in Traefik's ForwardAuth middleware when the `trustForwardHeader` setting is configured as `false` and Traefik is deployed behind a trusted upstream proxy. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to protected resources.

To mitigate this issue, ensure that the `trustForwardHeader` setting in Traefik's ForwardAuth middleware is not explicitly configured as `false` unless absolutely necessary. If Traefik is deployed behind a trusted upstream proxy, review the configuration to ensure that `trustForwardHeader` is either set to `true` or omitted, allowing Traefik to correctly process forwarded headers for authentication. If this configuration is modified, a restart or reload of the Traefik service may be required for the changes to take effect. Red Hat OpenShift Dev Spaces Affected devspaces/traefik-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-35051 https://nvd.nist.gov/vuln/detail/CVE-2026-35051 https://github.com/traefik/traefik/releases/tag/v2.11.43 https://github.com/traefik/traefik/releases/tag/v3.6.14 https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54