VYPR
← All advisories
High severity8.8NVD Advisory· Published Mar 27, 2026· Updated Apr 3, 2026

CVE-2026-33433

CVE-2026-33433

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when headerField is configured with a non-canonical HTTP header name (e.g., x-auth-user instead of X-Auth-User), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/traefik/traefik/v2Go
< 2.11.422.11.42
github.com/traefik/traefik/v3Go
>= 3.0.0-beta1, < 3.6.123.6.12
github.com/traefik/traefik/v3Go
>= 3.7.0-ea.1, < 3.7.0-ea.33.7.0-ea.3

Affected products

8

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.