Traefik vulnerability allows identity spoofing via header aliasing

Traefik versions v1.x, v2.11.55 and earlier, and v3.7.11 and earlier are affected by a medium severity vulnerability involving header aliasing, as detailed in the GitHub Security Advisory database. The issue arises from Traefik's handling of headers with names that alias one another. While Go canonicalizes header names based on dashes, it does not account for other forms such as underscores or dots. This discrepancy allows clients to smuggle headers like `X.Authenticated.User` alongside Traefik-managed headers such as `X-Authenticated-User`. Middleware such as ForwardAuth may inadvertently expose backend systems to spoofed identity values, as these backends often collapse aliases into a single variable.

To mitigate this, Traefik introduces the `aliasHeadersStrategy` option, which defaults to `keep` for backward compatibility. Operators must explicitly set this option to `delete` or `reject` to prevent aliasing issues. Upgrading to v2.11.56 or v3.7.12 is required to access this mitigation, as older versions will not receive patches.

Operators should carefully review their backend systems' handling of headers and test the new `aliasHeadersStrategy` setting before upgrading. Systems relying on the default behavior may experience compatibility issues, especially if they depend on header aliasing. This vulnerability highlights the importance of understanding how middleware and backend systems interpret headers differently.