CVE-2026-88008
published 2026-09-10CVE-2026-88008: Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header…
PriorityP338high7CVSS 4.0
AVNACLATPPRNUINVCNVINVANSCHSIHSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | traefik_traefik_v2 | >= 2.11.26 < 2.11.57 | 2.11.57 |
| github.com | traefik_traefik_v3 | >= 3.4.2 < 3.7.13 | 3.7.13 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik up to 2.11.56/3.7.12 HTTP/2 Upgrade access control (EUVD-2026-75545)
vuldb·2026-09-11·CVSS 7.0
CVE-2026-88008 [HIGH] Traefik up to 2.11.56/3.7.12 HTTP/2 Upgrade access control (EUVD-2026-75545)
A vulnerability identified as critical has been detected in Traefik up to 2.11.56/3.7.12. Affected by this issue is some unknown functionality of the component HTTP2 Upgrade Handler. Performing a manipulation results in improper access controls.
This vulnerability is reported as CVE-2026-88008. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
GHSA
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
ghsa·2026-09-10
CVE-2026-88008 [HIGH] CWE-444 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
## Summary
There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 `Upgrade` mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge (Go 1.24), a client-initiated `Upgrade: h2c` request header and its connection-specific `HTTP2-Settings` header were forwarded to the backend. A backend that honours the h2c upgrade and answers `101 Switching Protocols` puts Traefik into a raw byte tunnel that bypasses the router and the entire middleware chain (authentication, IPAllowList, rate limiting) on a shared backend. The fix stops forwarding the `Upgrade: h2c` token and the `HTTP2-Settings` header; `Upgrade: websocket` is unaf
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3https://github.com/traefik/traefik/pull/13797https://github.com/traefik/traefik/releases/tag/v2.11.57https://github.com/traefik/traefik/releases/tag/v3.7.13https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326
2026-09-10
Published