{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atraefiktraefik/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.9,"id":"CVE-2026-22045"},{"cvss":9.1,"id":"CVE-2024-5535"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["Traefik","nginx","HAProxy","Caddy","Traefik (v3.7.0 \u003c= v3.7.7)","Traefik (\u003c 3.6.25)","Traefik (\u003e= 3.7.0, \u003c 3.7.10)","Traefik (\u003c 2.11.53, \u003c 3.6.24, \u003c 3.7.9)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Traefik Labs","nginx","HAProxy","Caddy","Traefik"],"content_html":"\u003cp\u003eThis threat involves the abuse of the acme-tls/1 ALPN extension to trigger denial-of-service conditions against TLS-enabled reverse proxies. Attackers initiate high volumes of TLS connections advertising the acme-tls/1 extension, a protocol intended only for ACME TLS-ALPN-01 certificate validation, and deliberately stall the handshake process. By failing to complete the handshake, the attacker forces the destination service to maintain open connection states, effectively exhausting available goroutines, worker threads, or accept queue depths. This exploitation pattern is specifically documented as a technique to target CVE-2026-22045, which affects services like Traefik that lack adequate handshake timeout enforcement. When performed at scale, this resource exhaustion results in a denial-of-service (DoS) for legitimate users. Defenders should monitor for repeated incomplete TLS sessions originating from non-authorized sources to identify exploitation attempts against edge infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a denial of service on internet-facing reverse proxies and web application load balancers, impacting service availability. Affected infrastructure includes common reverse proxies such as Traefik, nginx, HAProxy, and Caddy. If handshake timeouts are not correctly configured, a relatively low-volume flood can exhaust server resources, causing service instability or total outage for the host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize hardening of all internet-facing TLS listeners to prevent resource exhaustion.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Traefik and other reverse proxies to versions that explicitly address CVE-2026-22045 and related handshake-timeout vulnerabilities.\u003c/li\u003e\n\u003cli\u003eEnforce strict \u003ccode\u003essl_handshake_timeout\u003c/code\u003e settings at the listener level to bound the duration any connection can remain in a pending state.\u003c/li\u003e\n\u003cli\u003eRate-limit inbound TLS connections per source IP at the network perimeter to mitigate the impact of connection-flooding attacks.\u003c/li\u003e\n\u003cli\u003eConfigure the Elastic Agent \u003ccode\u003enetwork_traffic\u003c/code\u003e integration with \u003ccode\u003einclude_detailed_fields: true\u003c/code\u003e to ensure visibility into ALPN extension fields.\u003c/li\u003e\n\u003cli\u003eSuppress noise by creating allowlists for known ACME Certificate Authority IP ranges (e.g., Let's Encrypt, ZeroSSL, Buypass) and internal certificate renewal agents.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T21:30:08Z","date_published":"2026-08-05T21:11:55Z","id":"https://feed.craftedsignal.io/briefs/2026-08-stalled-tls-handshakes/","summary":"Attackers are exploiting unpatched TLS listeners by flooding them with incomplete ACME ALPN handshakes to exhaust server-side resources like goroutines and worker threads.","title":"Service Exhaustion via Stalled TLS ALPN Handshakes","url":"https://feed.craftedsignal.io/briefs/2026-08-stalled-tls-handshakes/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-33433"},{"cvss":10,"id":"CVE-2026-39858"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["Traefik","Traefik (v2.11.x \u003c= 2.11.43, v3.6.x \u003c= 3.6.14, v3.7.x \u003c= 3.7.0-rc.2)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","header-injection","forwarded-headers","traefik"],"_cs_type":"advisory","_cs_vendors":["Traefik"],"content_html":"\u003cp\u003eA high severity authentication bypass vulnerability exists in Traefik versions before 2.11.43, 3.6.14, and 3.7.0-rc.2, affecting the \u003ccode\u003eForwardAuth\u003c/code\u003e middleware and snippet-based authentication. The vulnerability stems from incomplete sanitization of forwarded headers. Traefik's logic only targets canonical header names like \u003ccode\u003eX-Forwarded-Proto\u003c/code\u003e, failing to strip or normalize alias variants that use underscores instead of dashes (e.g., \u003ccode\u003eX_Forwarded_Proto\u003c/code\u003e). This allows attackers to inject spoofed trust context, such as a trusted scheme or host, through the alias headers. If the authentication backend normalizes underscore and dash header forms equivalently, an attacker can bypass authentication on protected routes without valid credentials. This impacts deployments where authorization decisions rely on forwarded headers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a Traefik instance using \u003ccode\u003eForwardAuth\u003c/code\u003e or snippet-based authentication.\u003c/li\u003e\n\u003cli\u003eThe attacker discovers that the authentication backend normalizes header names, treating \u003ccode\u003eX_Forwarded_Proto\u003c/code\u003e and \u003ccode\u003eX-Forwarded-Proto\u003c/code\u003e as equivalent.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP request with alias headers, such as \u003ccode\u003eX_Forwarded_Proto: https\u003c/code\u003e and \u003ccode\u003eX_Forwarded_Host: trusted.example\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eTraefik receives the request and forwards it to the authentication backend without sanitizing the alias headers.\u003c/li\u003e\n\u003cli\u003eThe authentication backend processes the request and normalizes the header names.\u003c/li\u003e\n\u003cli\u003eThe authentication backend evaluates trust predicates based on the spoofed values in the alias headers.\u003c/li\u003e\n\u003cli\u003eThe authentication backend incorrectly determines that the request is authenticated based on the spoofed trust context.\u003c/li\u003e\n\u003cli\u003eTraefik grants the attacker access to the protected resource, bypassing authentication.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows unauthenticated attackers to bypass authentication and access protected endpoints. In deployments where authorization decisions depend on forwarded headers, attackers can interact with backend services as if they were fully authenticated. This can expose sensitive internal functionality and data, potentially leading to data breaches or unauthorized access to critical systems. Successful exploitation undermines the security provided by \u003ccode\u003eForwardAuth\u003c/code\u003e and similar authentication mechanisms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Traefik to version 2.11.43, 3.6.14, or 3.7.0-rc.2 or later to address the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement a unified normalization policy across all forwarded header families, including RFC7239 and \u003ccode\u003eX-Forwarded-*\u003c/code\u003e to remediate the root cause.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Traefik ForwardAuth Bypass Attempt\u003c/code\u003e to identify exploitation attempts based on the presence of unusual \u003ccode\u003eX_Forwarded_*\u003c/code\u003e headers.\u003c/li\u003e\n\u003cli\u003eRestrict the headers forwarded to authentication services using an explicit allowlist to minimize the attack surface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T21:30:01Z","date_published":"2026-04-25T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-traefik-auth-bypass/","summary":"Traefik's `ForwardAuth` and snippet-based authentication middleware has a high severity authentication bypass vulnerability because it does not sanitize header aliases with underscores, allowing attackers to spoof trust context and bypass authentication on protected routes.","title":"Traefik ForwardAuth Authentication Bypass via Header Spoofing","url":"https://feed.craftedsignal.io/briefs/2026-04-traefik-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}