GO-2026-5532

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5532

Import Source

https://vuln.go.dev/ID/GO-2026-5532.json

JSON Data

https://api.test.osv.dev/v1/vulns/GO-2026-5532

Aliases

Published

2026-08-11T20:19:48Z

Modified

2026-08-11T20:45:08.331243273Z

Summary

Authorization and Cookie headers forwarded to error page service in github.com/traefik/traefik

Details

Traefik's errors middleware by default forwards all original request headers to the error page service. If the error page service is in a separate trust domain, this can lead to the disclosure of sensitive information such as Authorization or Cookie headers.

The fix adds an errorRequestHeaders option to the Errors middleware, allowing users to explicitly list which headers should be forwarded.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2026-5532",
    "review_status": "REVIEWED"
}

References

Affected packages

Go / github.com/traefik/traefik

Package

Name: github.com/traefik/traefik; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "Handler.ServeHTTP"
            ],
            "path": "github.com/traefik/traefik/middlewares/errorpages"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5532.json"

Go / github.com/traefik/traefik/v2

Package

Name: github.com/traefik/traefik/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.11.44

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "customErrors.ServeHTTP"
            ],
            "path": "github.com/traefik/traefik/v2/pkg/middlewares/customerrors"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5532.json"

Go / github.com/traefik/traefik/v3

Package

Name: github.com/traefik/traefik/v3; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/v3

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.15

Introduced

3.7.0-rc.1

Fixed

3.7.0-rc.3

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "customErrors.ServeHTTP"
            ],
            "path": "github.com/traefik/traefik/v3/pkg/middlewares/customerrors"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5532.json"