CVE-2026-33433 traefik CVE debrief

Who should care

Users of Traefik, an HTTP reverse proxy and load balancer, should be aware of this vulnerability if they are using versions prior to 2.11.42, 3.6.11, or 3.7.0-ea.3. This includes administrators and security teams responsible for maintaining Traefik installations, especially in environments where authentication and header handling are critical.

Technical summary

The vulnerability arises from Traefik's handling of HTTP headers. When a non-canonical HTTP header name is configured (e.g., 'x-auth-user' instead of 'X-Auth-User'), an authenticated attacker can inject their own canonical version of that header. This allows the attacker to impersonate any identity to the backend, as the backend reads the attacker-injected canonical header first, overriding Traefik's non-canonical write. The CVSS score for this vulnerability is 5.1, indicating a medium severity level.

Defensive priority

Defenders should prioritize patching Traefik installations to versions 2.11.42, 3.6.11, or 3.7.0-ea.3. In the meantime, they should monitor for suspicious header activity and ensure that only authorized users can configure header fields.

Recommended defensive actions

• Update Traefik to version 2.11.42, 3.6.11, or 3.7.0-ea.3 or later.
• Monitor Traefik logs for suspicious header activity.
• Restrict access to configure header fields to authorized users only.
• Review and update configurations to use canonical HTTP header names where possible.
• Implement additional monitoring to detect potential impersonation attempts.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Vendor advisories and release notes from Traefik offer patch details. Red Hat errata and security advisories provide additional context for affected users.

Official resources