7.5

CVE-2026-29054: Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)

Modified
AliasesGHSA-92mv-8f8w-wq52GO-2026-4597CGA-crwm-m37w-94f6
Published 05-03-2026Last modified 15-07-2026

Vulnerability summary

CVE-2026-29054 is a high (CVSS 7.5) Improper Handling of Case Sensitivity vulnerability in traefik. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.53%
0%100%
Low · -0.11 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 5
OPENSUSE-SU-2026:10314-1OPENSUSE-SU-2026:10323-1OPENSUSE-SU-2026:21483-1SUSE-SU-2026:1042-1CGA-GVXV-RMG5-P3HH

Timeline

  1. 05-03-2026
    PublishedVulnerability first disclosed.
  2. 15-07-2026
    Last modifiedVulnerability information updated.

Description

Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put in place to prevent the removal of Traefik-managed X-Forwarded headers (such as X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port, etc.) via the Connection header does not handle case sensitivity correctly. The Connection tokens are compared case-sensitively against the protected header names, but the actual header deletion operates case-insensitively. As a result, a remote unauthenticated client can use lowercase Connection tokens (e.g. Connection: x-real-ip) to bypass the protection and trigger the removal of Traefik-managed forwarded identity headers. This issue has been patched in versions 2.11.38 and 3.6.9.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.53%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

Decrease -0.11 pp

From 0.64% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard2 products
  • traefik-3.5All versions (No fix recorded)
  • traefik-fips-3.5All versions (No fix recorded)
Github.com/traefik/traefik2 products
  • v2≥ 2.11.9, < 2.11.38
  • v3≥ 3.1.3, < 3.6.9
Github.com/traefik1 product
  • traefikAll versions (No fix recorded)
Traefik1 product
  • traefik≥ 2.11.9, < 2.11.38 | ≥ 3.1.3, < 3.6.9

4 vendors · 6 products

References

10 links