CVE-2026-88008
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
Scoring
- Severity
- HIGH
- CVSS base score
- 7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- CWE
- CWE-444, CWE-863
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- traefik traefik
- traefik traefik
Weakness type
Related vulnerabilities
- CVE-2026-89044 — Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding
- CVE-2026-88009 — Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
- CVE-2026-81356 — Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-19203 — A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty...
- CVE-2026-18540 — undici vulnerable to downstream response splitting via retry interceptor
- CVE-2026-84380 — HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
- CVE-2026-84363 — Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
- CVE-2026-78605 — Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure