Description

Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-09-21T17:17:38.340Z",
  "pubdate": "2026-09-21T17:17:38.340Z",
  "executiveSummary": "A critical security flaw in the Fabio router allows unauthenticated remote attackers to manipulate critical request headers. The vulnerability exists because operator-configured headers, specifically ClientIPHeader, TLSHeader, and RequestID, are not properly protected against user-supplied input.\nBy leveraging this flaw, an attacker can strip or spoof these security-critical headers before they reach backend services. This bypasses authentication, auditing, and logging mechanisms that rely on accurate source identification and request correlation.\nThe vulnerability impacts Fabio versions 1.6.6 through 1.7.2. It is specifically triggered when proxy.header options are enabled. Attackers do not require prior authentication to exploit this, as the manipulation occurs at the request processing layer before reaching downstream application logic.\nThe primary risk involves the subversion of trust signals, which could lead to unauthorized access, identity spoofing, and the degradation of security telemetry required for incident response and regulatory compliance.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of header protection logic within the proxy subsystem. While CVE-2025-48865 introduced protective measures via protectHeaders in proxy/http_headers.go, the implementation fails to include operator-configured headers defined as ClientIPHeader, TLSHeader, and RequestID.\nIn proxy/http_proxy.go, the HTTPProxy.ServeHTTP method invokes addHeaders to inject these trust-critical headers. However, because these specific headers are not included in the protection scope, the subsequent Go ReverseProxy processing allows the inbound 'Connection' header logic—or direct header manipulation—to supersede or remove these injected values.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a malicious HTTP request containing headers designed to influence how Go's ReverseProxy handles connection upgrades or proxying. 2) Because Fabio fails to protect the configured ClientIPHeader, TLSHeader, and RequestID, the attacker can supply their own versions of these headers. 3) The proxy logic processes the request, and because the protective filtering in proxy/http_headers.go is incomplete, the attacker's supplied headers overwrite or delete the headers Fabio intends to set. 4) The modified request is forwarded to the backend service. 5) The backend, trusting the incoming headers for authorization decisions or audit logs, accepts the attacker's spoofed information as genuine metadata.\nThis vulnerability is restricted to deployments where the corresponding proxy.header options are explicitly configured. While the hardcoded forwarded headers are correctly protected, the omission of dynamic, user-defined configuration creates a gap that allows for the removal or alteration of security-critical signals. The vulnerability requires no authentication and is accessible to any entity capable of sending HTTP requests to the Fabio proxy instance. Successful exploitation results in the loss of client-IP visibility, incorrect TLS-termination status, and compromised request-correlation tracking, effectively rendering downstream security policies based on these headers ineffective."
}