Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service
Date: 2026-05
Affected: go/github.com/traefik/traefik/v3, go/github.com/traefik/traefik/v3, go/github.com/traefik/traefik/v2
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-41181
CWE: CWE-201

## Summary There is a medium severity information disclosure vulnerability in Traefik's `errors` (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request's complete header set, including `Authorization`, `Cookie`, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that `Host` is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the `errors` middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.44 - https://github.com/traefik/traefik/releases/tag/v3.6.15 - https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.3 ## For more information If there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues). <details> <summary>Original Description</summary> ## Description Traefik v3.6.13's supported HTTP `errors` middleware discloses sensitive request headers to the configured error page service when the original backend response matches the configured status range and the middleware takes its default header-forwarding path. In the re


Mitigations:

Architectural layers (MAESTRO):