CVE-2026-29054
- Source
- https://cve.org/CVERecord?id=CVE-2026-29054
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29054.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-29054
- Aliases
- Downstream
CGA (6)
CLEANSTART (2)
SUSE (1)
- Related
- Published
- 2026-03-05T16:18:49Z
- Modified
- 2026-10-21T02:30:50Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)
- Details
-
Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers (such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port, etc.) via the Connection header does not handle case sensitivity correctly. The Connection tokens are compared case-sensitively against the protected header names, but the actual header deletion operates case-insensitively. As a result, a remote unauthenticated client can use lowercase Connection tokens (e.g. Connection: x-real-ip) to bypass the protection and trigger the removal of Traefik-managed forwarded identity headers. This issue has been patched in versions 2.11.38 and 3.6.9.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-178" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29054.json" }- References
-
- https://github.com/traefik/traefik/releases/tag/v2.11.38
- https://github.com/traefik/traefik/releases/tag/v3.6.9
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29054.json
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/security/cve/CVE-2026-29054
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29054.json
- https://github.com/traefik/traefik/security/advisories/GHSA-92mv-8f8w-wq52
- https://nvd.nist.gov/vuln/detail/CVE-2026-29054
- https://bugzilla.redhat.com/show_bug.cgi?id=2444872
Affected packages
Git / github.com/traefik/traefik
Affected ranges
- Type
- GIT
- Repo
- https://github.com/traefik/traefik
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.11.9" }, { "fixed": "2.11.38" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.1.3" }, { "fixed": "3.6.9" } ], "source": "CPE_RANGE" }, { "original_tag": "v2.11.38", "range": [ { "fixed": "7c55452b21e7465d95bd731725c7222f7626265b" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v3.6.9", "range": [ { "fixed": "65f9d0663202b0ebf7941da0c4af0f1953525ce6" } ], "source": "REFERENCES_TAG" } ] }