GO-2026-5532
Authorization and Cookie headers forwarded to error page service in github.com/traefik/traefik
Quick fix
GO-2026-5532 — github.com/traefik/traefik/v2: upgrade to the fixed version with the command below.
go get github.com/traefik/traefik/v2@v2.11.44Details
Traefik's errors middleware by default forwards all original request headers to the error page service. If the error page service is in a separate trust domain, this can lead to the disclosure of sensitive information such as Authorization or Cookie headers.
The fix adds an errorRequestHeaders option to the Errors middleware, allowing users to explicitly list which headers should be forwarded.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for github.com/traefik/traefik (go modules). Pin to a known-safe version or switch to an alternative.
0Fixed in: 2.11.44go get github.com/traefik/traefik/v2@v2.11.440Fixed in: 3.6.15go get github.com/traefik/traefik/v3@v3.6.15