CVE-2026-88009
published 2026-09-10CVE-2026-88009: Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores…
PriorityP351high8.8CVSS 4.0
AVNACLATNPRNUINVCHVILVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | traefik_traefik_v2 | >= 0 < 2.11.57 | 2.11.57 |
| github.com | traefik_traefik_v3 | >= 3.0.0 < 3.7.13 | 3.7.13 |
| traefik | traefik | < 2.11.57 | 2.11.57 |
| traefik | traefik | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik Routing rewriteRequestBuilder authorization (EUVD-2026-75578)
vuldb·2026-09-11·CVSS 8.8
CVE-2026-88009 [HIGH] Traefik Routing rewriteRequestBuilder authorization (EUVD-2026-75578)
A vulnerability labeled as critical has been found in Traefik. This affects the function rewriteRequestBuilder of the component Routing. Executing a manipulation can lead to authorization bypass.
This vulnerability appears as CVE-2026-88009. The attack may be performed from remote. There is no available exploit.
GHSA
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
ghsa·2026-09-10
CVE-2026-88009 [HIGH] CWE-1286 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
## Summary
Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form (for example `GET http:http://internal-vhost/admin HTTP/1.1`). Go parses this into `URL.Opaque` with an empty `URL.Path`, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions against a path that normalizes to `/`, while the proxy forwards the attacker's original target byte-for-byte to the backend. Router path/prefix guards, `forwardAuth` path-scoped policies and the `encodedCharacters` hardening never see the real target, and the access log records every such request as `GET / HTTP/1.1`. Against a backend that
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9https://github.com/traefik/traefik/pull/13796https://github.com/traefik/traefik/releases/tag/v2.11.57https://github.com/traefik/traefik/releases/tag/v3.7.13https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724
2026-09-10
Published