CVE-2026-33433

Katalog CVE

CVSS 8.8 · High EPSS 0,57%

Kerentanan Authentication Bypass by Spoofing pada traefik. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-qr99-7898-vr7c exploit · patch · advisory vendor
• https://github.com/traefik/traefik/releases/tag/v2.11.42 product · release notes
• https://github.com/traefik/traefik/releases/tag/v3.6.11 product · release notes
• https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3 product · release notes
• https://access.redhat.com/errata/RHSA-2026:10175
• https://access.redhat.com/security/cve/CVE-2026-33433
• https://bugzilla.redhat.com/show_bug.cgi?id=2452289
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33433.json