CVE-2024-45410
Traefik ≤ 2.11.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-45410 is a critical-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Traefik Traefik. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Mark-of-the-Web Bypass (T1553.005); ranked in the top 28% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Traefik is a Go-based cloud native application proxy that adds trusted headers such as X-Forwarded-Host and X-Forwarded-Port to incoming HTTP requests before forwarding them to backend applications. CVE-2024-45410 is a header-manipulation flaw that allows HTTP/1.1 clients to remove or alter these headers by declaring them hop-by-hop through the Connection header, violating the expectation that the proxy alone controls their values. The issue affects all versions prior to the fixes released in 2.11.9 and 3.1.3 and carries a CVSS 3.1 score of 9.8 with CWE-345 and CWE-348.
An unauthenticated remote attacker can send a crafted HTTP/1.1 request that strips or overwrites the proxy-added headers, causing the downstream application to receive attacker-controlled values for host, port, or related forwarding information. Because many applications rely on these headers for routing, authentication, or access-control decisions, successful exploitation can lead to request smuggling, unauthorized access, or other integrity and confidentiality impacts without requiring any user interaction.
The official Traefik security advisory GHSA-62c8-mh53-4cqv and the corresponding release notes for versions 2.11.9 and 3.1.3 state that the vulnerability has been resolved and that no workarounds exist; users must upgrade to a patched release. The current EPSS score of 0.1395 with a peak of 0.1427 shows no material post-disclosure rise that would indicate emerging exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2723
Vulnerability Data
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client,…
more
it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 15 hardening rules · 6 OS baselines
V3.5.5
Mitigating Controls (NIST 800-53 r5) AI
Explicit requirement to protect session authenticity structurally prevents the weakness for communications.
Provenance tracking supplies the information needed to distinguish and prefer more-trusted sources, reducing the chance that a weaker source is chosen.
Information flow enforcement can require that data or decisions are taken only from explicitly approved, higher-trust sources rather than less-verified ones.
Device identification and authentication forces verification of the source before any data it supplies is used, eliminating reliance on unauthenticated inputs.
Integrity verification tools detect (but do not stop) the acceptance of data lacking authenticity.
Cryptographic mechanisms can be used to verify authenticity, thereby preventing acceptance of invalid data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit authenticity/integrity checks before use directly reduce selection of a less-trusted source.
CWE-345 directly impairs RC.RP-05's verification of restored-asset integrity/authenticity, largely defeating the outcome while still leaving other restoration-confirmation steps partially viable.
Correlating multiple sources can surface discrepancies that discourage reliance on the less-trusted one.
Protecting data-in-transit integrity helps ensure the more-trusted source is the one whose data is accepted.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles include trusted input channels and source verification mechanisms.
Security testing can detect missing or weak data authenticity verification.
Network controls can enforce authenticated channels, reducing risk of accepting unauthentic data.
Secure network services often include authenticity checks for data exchanged over those services.
Cryptographic mechanisms directly verify data origin and integrity, preventing acceptance of unauthentic data.
Secure SDLC incorporates authenticity verification requirements throughout development.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. prevents CWE-345
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345, CWE-348
Oracle Linux 9 (1 rule)
- V-271525 OL 9 must have GPG signature verification enabled for all software repositories. prevents CWE-345, CWE-348
RHEL 7 (2 rules)
- V-204447 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345, CWE-348
- V-204448 The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345
RHEL 8 (2 rules)
- V-230264 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345
- V-230265 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-345
RHEL 9 (1 rule)
- V-257822 RHEL 9 must have GPG signature verification enabled for all software repositories. prevents CWE-345