Loading story…
Traefik disclosed and patched multiple vulnerabilities that let unauthenticated attackers bypass authentication and authorization controls by abusing forwarded-header handling. The most severe issue, CVE-2026-54763 with a CVSS 10.0, allows BasicAuth, DigestAuth, and ForwardAuth protections to be bypassed through underscore-variant header injection that can spoof identity or authorization context. Two related flaws, CVE-2026-54764 and CVE-2026-54765, respectively enable bypass of port-based authorization checks in ForwardAuth via injected X-Forwarded-Proto values and leak backend context across Kubernetes Gateway API routes that share the same Service:port.
The disclosures build on earlier high-severity Traefik ForwardAuth bugs, CVE-2026-35051 and CVE-2026-39858, which exposed protected routes when Traefik was deployed behind an upstream proxy or when downstream systems normalized underscore-form headers such as X_Forwarded_Proto and X_Forwarded_User. Affected versions span Traefik v2 and v3 releases prior to the vendor fixes, including 2.11.51, 3.6.22, and 3.7.6 for the latest issues, with the newer bugs described as evidence that earlier header-sanitization fixes were incomplete. The flaws put services commonly protected by ForwardAuth—such as Grafana, Kibana, Portainer, Kubernetes Dashboard, internal APIs, and admin panels—at risk, although no public exploits were reported at disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Later reporting stated that CVE-2026-54763 showed the initial underscore-header fix from the April 2026 issues was incomplete. This linked the new critical auth-bypass bug to the earlier ForwardAuth header-sanitization weaknesses.
The April 2026 disclosures affected Traefik v2 before 2.11.43, v3 before 3.6.14, and v3.7 before 3.7.0-rc.2, indicating patched releases at those versions and later. The fixes addressed ForwardAuth authentication bypass conditions tied to forwarded-header handling.
Two high-severity Traefik ForwardAuth vulnerabilities, CVE-2026-35051 and CVE-2026-39858, were disclosed in April 2026. The flaws allow unauthenticated attackers to bypass authentication via unsanitized X-Forwarded-Prefix handling and underscore-form forwarded headers.
At the time the July vulnerability cluster was disclosed, the reporting stated there were no known public exploits available. This accompanied disclosure of the patched CVEs affecting Traefik authentication and routing behavior.
Traefik released emergency security updates for CVE-2026-54763, CVE-2026-54764, and CVE-2026-54765 affecting versions prior to 2.11.51, 3.6.22, and 3.7.6. The flaws included authentication bypass, port-based authorization bypass, and backend context leakage in Kubernetes Gateway API deployments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BeyondTrust disclosed multiple vulnerabilities affecting **Remote Support** and **Privileged Remote Access** appliances, including two critical pre-authentication authentication-bypass flaws tracked as `CVE-2026-40138` and `CVE-2026-40139`. Both issues carry **CVSS 9.2** ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, `CVE-2026-40140`, was rated **CVSS 8.7** and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem. BeyondTrust also addressed `CVE-2026-40141`, a **CVSS 8.5** vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are **Remote Support 25.3.2 and earlier** and **Privileged Remote Access 25.3.2 and earlier**. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.
Jul 9, 2026
Fortinet disclosed **CWE-602** authorization bypass flaws in **FortiManager** and **FortiAnalyzer** that let authenticated low-privilege users reach privileged web-console functions and perform unauthorized operations by sending crafted requests. The advisories say affected releases span multiple **FortiManager**, **FortiAnalyzer**, and **FortiAnalyzer-BigData** branches, while newer branches such as **FortiAnalyzer 7.6** and **FortiManager 7.6** are not affected and fixed versions are available for supported lines. Fortinet credited researchers from **Orange Cyberdéfense**, **Orange CERT-CC**, and **Synacktiv** for responsible disclosure. Synacktiv detailed how the FortiManager issue, tracked as **`CVE-2024-23666`**, allowed a user with read-only or restricted privileges to access administrative features including full configuration backup, configuration import upload, and the remote SSH web console for managed **FortiGate** devices. Exported backups could expose hashed or encrypted credentials for FortiManager and managed devices, enabling further privilege escalation, and the configuration import path could be chained with **`CVE-2023-42791`** to obtain root access on the underlying system. The researchers also published detection guidance aimed at spotting suspicious configuration downloads by non-admin accounts.
Jul 9, 2026
Two high-severity vulnerabilities in **OAuth2 Proxy** can let unauthenticated remote attackers reach protected upstream resources in specific reverse-proxy deployments. `CVE-2026-34457` affects versions prior to **7.15.2** when OAuth2 Proxy is used with **auth_request**-style integrations such as nginx `auth_request` and either `--ping-user-agent` or `--gcp-healthchecks` is enabled. In that configuration, any request carrying the configured health-check User-Agent can be treated as a successful health check regardless of the requested path, creating an authentication bypass. The flaw is tracked as **CWE-290** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-40575`, affects OAuth2 Proxy versions **7.5.0 through 7.15.1** when `--reverse-proxy` is enabled alongside `--skip-auth-regex` or `--skip-auth-route`. In those setups, the product may trust a client-supplied `X-Forwarded-Uri` header, allowing attackers to spoof the header so authentication and skip-auth rules are evaluated against a different path than the one actually forwarded upstream. Both issues were fixed in **OAuth2 Proxy 7.15.2**. Recommended mitigations include upgrading immediately, stripping or overwriting `X-Forwarded-Uri`, restricting direct access to OAuth2 Proxy, and narrowing or removing skip-auth rules where possible.
Jun 29, 2026