CVE-2026-29054: Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

What it is stated by the CNA

Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers (such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port, etc.) via the Connection header does not handle case sensitivity correctly. The Connection tokens are compared case-sensitively against the protected header names, but the actual header deletion operates case-insensitively. As a result, a remote unauthenticated client can use lowercase Connection tokens (e.g. Connection: x-real-ip) to bypass the protection and trigger the removal of Traefik-managed forwarded identity headers. This issue has been patched in versions 2.11.38 and 3.6.9.

weakness

CWE-178: Improper Handling of Case Sensitivity

affected

traefik

published ranges

traefik >= 2.11.9 < 2.11.38; traefik >= 3.1.3 < 3.6.9

first unaffected version, by branch

traefik 2.11.38; traefik 3.6.9

fixed by package (from OSV advisories)

github.com/traefik/traefik/v2 (Go): 2.11.38 GHSA-92mv-8f8w-wq52 GO-2026-4597github.com/traefik/traefik/v3 (Go): 3.6.9 GHSA-92mv-8f8w-wq52 GO-2026-4597

later fixes (from OSV advisories)

github.com/traefik/traefik/v2 2.11.38 is inside a range CVE-2026-32305 (GHSA-wvvq-wgcr-9q48) lists as affected. That advisory is fixed in 2.11.41.github.com/traefik/traefik/v2 2.11.38 is inside a range CVE-2026-32595 (GHSA-g3hg-j4jv-cwfr) lists as affected. That advisory is fixed in 2.11.41.github.com/traefik/traefik/v2 2.11.38 is inside a range CVE-2026-33433 (GHSA-qr99-7898-vr7c) lists as affected. That advisory is fixed in 2.11.42.github.com/traefik/traefik/v2 2.11.38 is inside a range CVE-2026-35051 (GHSA-6384-m2mw-rf54) lists as affected. That advisory is fixed in 2.11.43.github.com/traefik/traefik/v2 2.11.38 is inside a range CVE-2026-39858 (GHSA-5m6w-wvh7-57vm) lists as affected. That advisory is fixed in 2.11.43.github.com/traefik/traefik/v2 2.11.38 is inside a range CVE-2026-40912 (GHSA-6jwx-7vp4-9847) lists as affected. That advisory is fixed in 2.11.43.

severity

7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

assigned by

GitHub_M

published

2026-03-05

check us github.com github.com github.com

Exploit code held, dated

exploit code

None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

8 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2026-29054', '2026-10-30T23:59:59.999999Z', now());