Traefik: four CVEs break routing, header and identity boundaries

Traefik has released fixes for four vulnerabilities with a common theme: the proxy made a security decision using one view of a request or connection while the backend received, or shared, another. The result can be authentication bypass, path-policy bypass, trusted-header injection and loss of observability.

The fixed releases are Traefik 3.7.13 and 2.11.57. The most severe, CVE-2026-88007, is critical and concerns backend connection reuse when HTTP/3 meets NTLM or Negotiate. Three high-severity bugs cover an h2c tunnel, an unusual request-target form and trusted names carried in trailers.

CVE-2026-88007: another user’s identity on a backend connection

NTLM and Negotiate can bind authentication state to a persistent connection rather than authenticate every independent request. A proxy must therefore prevent a backend connection used for one client from being assigned to another client in a way that preserves the first identity.

Traefik’s HTTP/3 path failed to initialise the mechanism that isolates backend transport per frontend connection on HTTP/1.1 and HTTP/2. A different client’s request could consequently land on a connection already authenticated as the victim. That could expose victim-only data or allow actions as that person without their credentials.

Not every Traefik deployment meets the prerequisites. The entrypoint must have HTTP/3 enabled, the backend must use connection-bound NTLM or Negotiate authentication, and backend keep-alive must be active. Ordinary per-request authentication does not have this connection-state model.

Affected releases are 3.0.0–3.7.12 and 2.11.0–2.11.56, fixed in 3.7.13 and 2.11.57 respectively.

CVE-2026-88008: h2c creates a tunnel outside middleware

The second issue affects the HTTP/1.1 Upgrade mechanism. Traefik forwarded a client-requested h2c upgrade and the connection-specific HTTP/2 settings header to a backend. If that backend accepted the upgrade and replied with status 101, the proxy switched into a raw byte tunnel.

Once established, later HTTP/2 requests no longer passed through Traefik’s router and middleware chain. When public and protected routes shared a backend, a public path could provide a tunnel to a path protected by BasicAuth, ForwardAuth, IPAllowList or rate limiting. The tunneled requests also bypassed normal proxy access logging, metrics and tracing.

The backend must support the client-initiated h2c upgrade in the described manner; project testing did not find common off-the-shelf servers exploitable. This is not a claim that every HTTP/2 backend is vulnerable. Affected releases are 3.4.2–3.7.12 and 2.11.26–2.11.56.

CVE-2026-88009: the router sees /, the backend sees another target

Traefik accepted an HTTP/1.x request target in an unusual rootless form. Go represented it as an opaque value with an empty path. Routing, path sanitisation, middleware and access logging consequently evaluated a path normalised to /, while the proxy forwarded the original bytes to the backend.

If a backend interpreted that form as a different path or host, policy and execution diverged: access control saw /, while the application received an administrative target. Potential effects include bypassing path and prefix rules, ForwardAuth policy and virtual-host boundaries. Traefik’s access log also recorded the request as /, making triage harder.

The issue affects 3.0.0–3.7.12 and all v2 releases through 2.11.56. Unlike the NTLM scenario it does not require HTTP/3, although impact still depends on how the backend parses the unusual request target.

CVE-2026-88004: a trusted name returns as a trailer

The aliasHeadersStrategy, underscoreHeadersStrategy and default stripping of untrusted X-Forwarded-* names inspected ordinary headers but not request trailers. A client could therefore deliver the same trusted or aliasing name later in an HTTP/1.1 or HTTP/2 trailer section.

Impact is greatest when middleware buffers the body and a backend merges trailers into its header namespace before making an identity or trust decision. The fix stops forwarding request-trailer values to the backend. This flaw affects Traefik 3.2.0–3.7.12 only; v2 uses a different reverse-proxy implementation and is not affected by this CVE.

Upgrade without losing operational context

First inventory versions across container images, Helm charts, DaemonSets, virtual machines and standby ingress instances. Then:

1. update the supported branch to 3.7.13 or 2.11.57;
2. move v3.2–v3.6 deployments to v3.7.13 because those branches are end-of-life and will not receive their own fixes;
3. read the migration guide linked from the relevant release;
4. test routing, middleware, WebSocket, HTTP/3, h2c or gRPC and backend authentication;
5. verify the version of the running process, not merely an image tag in source control.

If the change cannot land immediately, disabling HTTP/3 reduces the CVE-2026-88007 path, while stripping client-requested h2c upgrades before Traefik can constrain CVE-2026-88008. These are narrow mitigations, not replacements for updating the full set.

Triage must extend beyond the proxy layer

Do not base the investigation only on Traefik access logs. CVE-2026-88008 can move later traffic into a raw tunnel, while CVE-2026-88009 can record an unusual request as /. Preserve and correlate logs from backends, the identity provider, WAF, load balancer and applications.

For NTLM or Negotiate environments, look for actions attributed to a user without a corresponding authentication sequence and from an unexpected HTTP/3 client. For path routing, compare the edge-recorded path with what the application parsed. For trailers, confirm whether the backend or its library actually merges them with headers.

The project advisories do not report active exploitation of these four vulnerabilities. The detection guidance above is Breachroad’s recommendation derived from the documented interpretation gaps and must be adapted to local telemetry.

Sources and next steps

The prerequisites, version ranges and impacts come from Traefik’s official advisories for CVE-2026-88007, CVE-2026-88008, CVE-2026-88009 and CVE-2026-88004. Fixed versions and migration links are in the Traefik 3.7.13 and 2.11.57 release notes.

The cluster shows why a proxy rule and the application’s interpretation must be tested as one chain. Our guide to web cache poisoning and cache deception examines related disagreement bugs. We help teams practise shared response through cybersecurity training and validate routing and authorisation boundaries through web and API penetration testing.