Nixpkgs security tracker
NIXPKGS-2026-1344
GitHub issue
published 1 month, 1 week ago
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse ignored package traefik-certs-dumper
- @LeSuisse ignored
- @LeSuisse accepted
- @LeSuisse published on GitHub
Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
References
-
https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54 x_refsource_CONFIRM
Ignored references (3)
-
https://github.com/traefik/traefik/releases/tag/v2.11.43 x_refsource_MISC
-
https://github.com/traefik/traefik/releases/tag/v3.6.14 x_refsource_MISC
-
https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 x_refsource_MISC
Affected products
traefik
- ==< 2.11.43
- ==>= 3.7.0-ea.1, < 3.7.0-rc.2
- ==>= 3.0.0-beta1, < 3.6.14
Matching in nixpkgs
pkgs.traefik
Modern reverse proxy
-
nixos-unstable 3.7.0-ea.2
- nixpkgs-unstable 3.7.0-ea.2
- nixos-unstable-small 3.7.0-ea.2
Ignored packages (1)
pkgs.traefik-certs-dumper
Dump ACME data from traefik to certificates
Package maintainers
-
@djds djds <git@djds.dev>
-
@vdemeester Vincent Demeester <vincent@sbr.pm>