Bug 2497501 (CVE-2026-54764)

Summary: CVE-2026-54764 traefik: Traefik: Authorization bypass in ForwardAuth middleware via forged X-Forwarded-Port
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: sdawley
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. The ForwardAuth middleware, even when configured to not trust forwarded headers, incorrectly uses the original incoming request to determine the X-Forwarded-Port header sent to the authentication service. This allows an unauthenticated remote attacker to inject a false X-Forwarded-Proto: https header over a plain HTTP connection, leading Traefik to forward X-Forwarded-Port: 443 to the authentication service. This bypasses port-based authorization checks, potentially granting unauthorized access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-06 21:01:37 UTC 
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. As a result, an unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.