Definition. In header spoofing, a client itself sends HTTP headers that an upstream proxy is supposed to set, such as the client IP in X-Forwarded-For or the result of a certificate check. If the backend believes these headers, it adopts the attacker's claim.

Why it matters. Behind a reverse proxy, identity often travels only as a header. The proxy therefore has to delete such headers first on every path and only set them from verified state. One variant uses underscores: under the CGI rules in RFC 3875, hyphens become underscores, so X_Forwarded_For and X-Forwarded-For map to the same name under CGI and FastCGI.

Example. With CVE-2026-114640 in Traefik, a client without a certificate could send Ssl-Client-Verify: SUCCESS and pose as any mTLS identity. In June 2026, FrankenPHP 1.12.4 closed a variant using underscore headers.

Related. mTLS, Ingress controller, CVE