---
id: CVE-2022-23469
aliases:
  - GHSA-h2ph-vhm7-g4hp
  - GO-2022-1154
title: Traefik may display authorization header in the debug logs
summary: Traefik may display authorization header in the debug logs
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N'
vendor: traefik
product: github.com/traefik/traefik/v2
ecosystem: go
affected:
  - github.com/traefik/traefik/v2 < 2.9.6
patched:
  - github.com/traefik/traefik/v2 2.9.6
published: '2022-12-08'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-h2ph-vhm7-g4hp'
references:
  - url: 'https://github.com/traefik/traefik/security/advisories/GHSA-h2ph-vhm7-g4hp'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23469'
  - url: 'https://github.com/traefik/traefik/pull/9574'
  - url: 'https://github.com/traefik/traefik'
  - url: 'https://github.com/traefik/traefik/releases/tag/v2.9.6'
tags:
  - osv
  - go
epss: 0.01005
epssPercentile: 0.61373
ingestedAt: '2026-08-07T19:14:17.112Z'
---

## Overview

### Impact

There is a potential vulnerability in Traefik displaying the Authorization header in its debug logs.

Traefik uses [oxy](https://github.com/vulcand/oxy) to provide the following features:

- Round Robin: https://doc.traefik.io/traefik/routing/services/#weighted-round-robin-service
- Buffering: https://doc.traefik.io/traefik/middlewares/http/buffering/
- Circuit Breaker: https://doc.traefik.io/traefik/middlewares/http/circuitbreaker/
- In-Flight Requests: https://doc.traefik.io/traefik/middlewares/http/inflightreq/

In such cases, if the log level is set to DEBUG, the credentials provided using the Authorization header are displayed in the debug logs:

```
level=debug msg="vulcand/oxy/roundrobin/rr: completed ServeHttp on request" Request="{\\"Method\\":\\"POST\\",\\"URL\\":{\\"Scheme\\":\\"\\",\\"Opaque\\":\\"\\",\\"User\\":null,\\"Host\\":\\"\\",\\"Path\\":\\"/<redacted>/<redacted>\\",\\"RawPath\\":\\"\\",\\"ForceQuery\\":false,\\"RawQuery\\":\\"\\",\\"Fragment\\":\\"\\",\\"RawFragment\\":\\"\\"},\\"Proto\\":\\"HTTP/2.0\\",\\"ProtoMajor\\":2,\\"ProtoMinor\\":0,\\"Header\\":{\\"Authorization\\":[\\"Bearer <token value was here>\\"],\\"Content-Type\\":[\\"application/grpc\\"],\\"Grpc-Accept-Encoding\\":[\\"gzip\\"],\\"Grpc-Timeout\\":[\\"29999886u\\"],\\"Te\\":[\\"trailers\\"],\\"User-Agent\\":[\\"<redacted>\\"],<remainder of log message removed>
```

### Patches

https://github.com/traefik/traefik/pull/9574
https://github.com/traefik/traefik/releases/tag/v2.9.6

### Workarounds

Set the log level to `INFO`, `WARN`, or `ERROR`.

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

## Affected packages

- `github.com/traefik/traefik/v2 < 2.9.6`

## Remediation

Upgrade to a patched release:

- `github.com/traefik/traefik/v2 2.9.6`