CVE-2026-88009 — HTTP Request Smuggling

Vendor	Product	Version range	Fixed in
devspaces	traefik-rhel9	—	—
github.com	traefik_traefik_v2	>= 0 < 2.11.57	2.11.57
github.com	traefik_traefik_v3	>= 3.0.0 < 3.7.13	3.7.13
traefik	traefik	< 2.11.57	2.11.57
traefik	traefik	—	—
traefik	traefik	>= 3.0.0 < 3.7.13	3.7.13

VulDB

Traefik Routing rewriteRequestBuilder authorization (EUVD-2026-75578)

vuldb·2026-09-11·CVSS 8.8

CVE-2026-88009 [HIGH] Traefik Routing rewriteRequestBuilder authorization (EUVD-2026-75578) A vulnerability labeled as critical has been found in Traefik. This affects the function rewriteRequestBuilder of the component Routing. Executing a manipulation can lead to authorization bypass. This vulnerability appears as CVE-2026-88009. The attack may be performed from remote. There is no available exploit.

GHSA

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

ghsa·2026-09-10

CVE-2026-88009 [HIGH] CWE-1286 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging ## Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form (for example `GET http:http://internal-vhost/admin HTTP/1.1`). Go parses this into `URL.Opaque` with an empty `URL.Path`, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions against a path that normalizes to `/`, while the proxy forwards the attacker's original target byte-for-byte to the backend. Router path/prefix guards, `forwardAuth` path-scoped policies and the `encodedCharacters` hardening never see the real target, and the access log records every such request as `GET / HTTP/1.1`. Against a backend that

Red Hat

github.com/traefik/traefik: Traefik: Authorization bypass and access-log evasion via crafted HTTP/1 request

vendor_redhat·2026-09-10·CVSS 8.2

CVE-2026-88009 [HIGH] CWE-551 github.com/traefik/traefik: Traefik: Authorization bypass and access-log evasion via crafted HTTP/1 request github.com/traefik/traefik: Traefik: Authorization bypass and access-log evasion via crafted HTTP/1 request Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13. A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. This vulnera

CVE-2026-88009: Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores…

Affected

CVSS provenance