CVE-2026-33433

What it is

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject their own canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Versions 2.11.42, 3.6.11, and 3.7.0-ea.3 patch the issue.

At a glance

Exploitability

Can be exploited over the network with an admin-level account. Limited direct impact.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-03-27 15:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-07-15 02:20 UTC Last updatedMost recent change to the record

Details

Published

2026-03-27 15:16 UTC

Last modified

2026-07-15 02:20 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-290

Record status

Modified

Affected

• Traefik < 2.11.42
• Traefik < 3.6.12
• Traefik 3.7.0

Attack profile CVSS 4.0 · 5.1

Attack vector

Network

Complexity

High

Attack requirements

Present

Privileges needed

High

User interaction

None

Confidentiality

None

Integrity

None

Availability

None