CVE-2026-88877
published 2026-09-10CVE-2026-88877: Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.65%
50.5th percentile
Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| traefik | traefik | >= 3.7.0 < 3.7.12 | 3.7.12 |
| traefik | traefik | 3.7.0 – 3.7.13 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/traefik/traefik: Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
vendor_redhat·2026-09-10·CVSS 9.8
CVE-2026-88877 [CRITICAL] CWE-639 github.com/traefik/traefik: Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
github.com/traefik/traefik: Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
A flaw was found in Traefik's Kubernetes ingress-nginx provider. A remote attacker, by sending a specially crafted request with a malformed Host header (e.g., containing a non-numeric port), can bypass security middlewares, including authentication and IP allowlisting. This leads to unauthorized access to protected backend services.
Statement: A flaw was found in Traefik's Kubernetes ingress-nginx provider (v3.7.0 through v3.7.11) when handling Ingresses carrying both authentication annotations and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a sibling router with a RedirectRegex middleware that matches on host alone. Requests containing non-numeric or empt
GHSA
Traefik is a HTTP reverse proxy and load balancer.
ghsa_unreviewed·2026-09-10
CVE-2026-88877 [CRITICAL] CWE-639 Traefik is a HTTP reverse proxy and load balancer.
Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.ex
No detection rules found.
No public exploits indexed.
2026-09-10
Published