GO-2026-5532
Authorization and Cookie headers forwarded to error page service in github.com/traefik/traefik
Quick fix
GO-2026-5532 — github.com/traefik/traefik/v2: upgrade to the fixed version with the command below.
go get github.com/traefik/traefik/v2@v2.11.44Details
Traefik's errors middleware by default forwards all original request headers to the error page service. If the error page service is in a separate trust domain, this can lead to the disclosure of sensitive information such as Authorization or Cookie headers.
The fix adds an errorRequestHeaders option to the Errors middleware, allowing users to explicitly list which headers should be forwarded.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 No fixed version published yet for github.com/traefik/traefik (go modules). Pin to a known-safe version or switch to an alternative.
0 Fixed in: 2.11.44 go get github.com/traefik/traefik/v2@v2.11.44 0 Fixed in: 3.6.15 go get github.com/traefik/traefik/v3@v3.6.15