Dot-Form Header Aliases: How Traefik ForwardAuth Identity Spoofing Reached Backends Before 2.11.56

Why this matters to anyone running a proxy in front of an application

A common architecture puts a reverse proxy in front of an application and lets the proxy decide who the caller is. The proxy validates a session or a JWT, then writes an identity header such as X-Authenticated-User into the upstream request. The backend trusts that header because it cannot see the proxy's decision-making.

CVE-2026-88879 breaks that trust contract in Traefik. The flaw is not a memory-safety bug, and it does not require a compromised proxy. It requires a backend that collapses header names into one variable, which is exactly what CGI, WSGI, PHP and NGINX do.

Technical context: how HTTP header names are compared

Traefik canonicalizes header names only on dashes. X-Auth-User, X_Auth_User and X.Auth.User therefore remain three distinct headers in Traefik's view. Many backend runtimes do not preserve that distinction. When a CGI-style environment is built, dots and underscores are typically folded into underscores, so all three names collapse into a single variable.

In the tested configuration, a PHP 8.2 built-in SAPI over an HTTP/1 backend path, Go's lexical header ordering makes the attacker-supplied value win deterministically. Any header Traefik sets is affected, not only the one written by ForwardAuth middleware.

Explanation: the spoofing sequence

Consider a deployment where ForwardAuth admits a caller and writes X-Authenticated-User: alice. An attacker sends the canonical header with a low-privilege identity and adds a second header using a dot-form alias such as X.Authenticated.User: admin.

Traefik treats the alias as an unrelated header, so the middleware that manages the canonical name does not manage the alias. The backend then folds both names into one variable. If ordering favors the alias, the application reads admin as the authenticated identity. The attacker gains the privileges of a different user or role without breaking any authentication check at the proxy.

Version impact and the incomplete first fix

The affected ranges are Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11. Fixed versions are v2.11.56 and v3.7.12. The advisory describes this as an incomplete fix for GHSA-x677-9fxg-v5c5, which blocked only the underscore form of the alias.

One detail deserves emphasis for operators: the fix adds an entry point option named aliasHeadersStrategy. Because it defaults to keep for backwards compatibility, upgrading without setting it does not change behaviour. It must be set explicitly to delete or reject. An upgrade that stops at the version number leaves the bypass in place.

Severity reporting differs by source, which is useful context rather than noise. The NVD record carries a CVSS 3.1 base score of 8.2 with CWE-290, Authentication Bypass by Spoofing, while the VulnCheck advisory lists a CVSS 4.0 score of 5.3. The difference reflects the conditional parts of the chain: a specific backend behaviour and header ordering must both hold.

Defensive implications

Start by inventorying which backends sit behind Traefik and how they map header names. PHP, CGI, WSGI and similar stacks are the ones to check first.

Patch to v2.11.56, v3.7.12 or a later release in the same line, then set aliasHeadersStrategy to delete or reject at the entry point. Confirm the setting is present in the deployed configuration rather than only in the repository. Unmaintained release lines will not receive a patch, so those deployments need a migration plan rather than a waiting period.

Treat middleware-injected identity headers as untrusted input at the application layer. Applications that read an identity header should reject requests carrying both a canonical name and a folded alias, and should not rely solely on a proxy-written header when a session cookie or signed token could carry the same claim.

Finally, test the behaviour rather than assuming it. A request that carries both header forms against a staging backend shows immediately whether the application collapses the names and which value wins.

References

• Traefik security advisory GHSA-rf44-j88r-hh8c, ForwardAuth identity spoofing via dot-form header alias.
• VulnCheck advisory: Traefik before v2.11.56 identity spoofing via header alias.
• NVD record for CVE-2026-88879.
• Traefik release pages for v2.11.57 and v3.7.13, in the release lines that contain the fix.