CVE-2026-54763

score

0.1

cvss

10.0

epss

0.2%

published

2026-07-06

kev added

—

first seen

2026-10-21

Traefik < 2.11.51, < 3.6.22, and < 3.7.6 contain an authentication bypass caused by improper stripping of underscore-variant identity headers in BasicAuth, DigestAuth, and ForwardAuth middlewares, letting attackers spoof identity or authorization context by injecting headers, exploit requires attacker to reach a protected route.