Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
Date: 2026-03
Affected: go/github.com/traefik/traefik/v3, go/github.com/traefik/traefik/v3, go/github.com/traefik/traefik/v2
Attack vector: deepfake
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-32305
CVE-2026-33433
CWE: CWE-287
CWE-290

## Summary There is a potential vulnerability in Traefik's Basic and Digest authentication middlewares when `headerField` is configured with a non-canonical HTTP header name. An authenticated attacker with valid credentials can inject the canonical version of the configured header to impersonate any identity to the backend. Because Traefik writes the authenticated username using a non-canonical map key, it creates a separate header entry rather than overwriting the attacker's canonical one — causing most backend frameworks to read the attacker-controlled value instead. ## Patches - <https://github.com/traefik/traefik/releases/tag/v2.11.42> - <https://github.com/traefik/traefik/releases/tag/v3.6.12> - <https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.3> ## For more information If there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues). --- <details> <summary>Original Description</summary> ### Summary When `headerField` is configured with a non-canonical HTTP header name (e.g., `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject a canonical version of that header to impersonate any identity to the backend. The backend receives two header entries — the attacker-injected canonical one is read first, overriding Traefik's non-canonical write. Tested on Traefik v3.6.10. ### Details At `pkg/middlewares/auth/basic_auth.go:92`, the authenticated username is written using d


Mitigations:

Architectural layers (MAESTRO):