CVE-2026-88879
Traefik canonicalizes header names on dashes only, so X-Auth-User, X_Auth_User and X.Auth.User are three headers to Traefik and ONE variable to a CGI/WSGI/PHP/NGINX backend - a client smuggles a dot-form alias past the middleware that manages the canonical header and the backend reads the attacker's value as the asserted identity (CVSS 5.3)
- Severity
- medium
- Affected product
- Traefik
- Affected versions
- Traefik ≥ 2.0.0, < 2.11.56
- Affected versions
- Traefik ≥ 3.0.0, < 3.7.12
- Fixed in
- Traefik 2.11.56
- Fixed in
- Traefik 3.7.12
- Detection basis
- Appliance fingerprint
- Shipped rule
- Traefik: Traefik canonicalizes header names on dashes only, so X-Auth-User, X_Auth_User and X.Auth.User are three headers to Traefik and ONE variable to a CGI/WSGI/PHP/NGINX backend - a client smuggles a dot-form alias past the middleware that manages the canonical header and the backend reads the attacker's value as the asserted identity (CVSS 5.3)
- Added to NewScan
- 2026-09-11
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
APPLIANCE FINGERPRINT
NewScan fingerprints the Traefik appliance and reports this CVE when the detected version falls inside the affected range below.
APPLIANCE FINGERPRINT
NewScan fingerprints the Traefik appliance and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.