Traefik entrypoint header-name sanitization bypassed via request trailers

Published September 10, 2026 CVE-2026-88004

Traefik can let an unauthenticated remote user bypass protections on trusted request headers. In certain setups, a backend may accept attacker-controlled identity or routing information.

Severity
HighCVSS 4.0 · 7.0
Fix
Fixed in 3.7.13Fix recorded today
Affected versions
3.2.0 or newer, but before 3.7.13
Weakness
CWE-436
Exploit likelihood
0.29% in 30 daysEPSS, higher than 21% of known flaws
Affects
Traefik

How it works

  • An attacker sends extra request metadata after the main headers, called a trailer.
  • Traefik checks the main headers but misses this later metadata.
  • When retry or buffering middleware reads the request body first, the trailer value can reach a backend.
  • That backend may merge it with normal headers and trust the attacker-controlled identity or routing information.

What to do

Check the Traefik version used by each deployment and compare it with the advisory. Versions from 3.2.0 through 3.7.12 are in scope; Traefik v2 is not affected by this advisory.

Upgrade affected deployments to Traefik 3.7.13. Use the Traefik advisory for deployment-specific guidance.

Technical details

CVE-2026-88004 affects Traefik v3.2.0 through v3.7.12. Its protections inspect normal request headers but not later trailer metadata, allowing trusted or aliasing names to pass through. When middleware buffers the request body, attacker-chosen trailer values can reach backends that merge trailers into their header namespace.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity High Attacker must bypass specific built-in protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure High Sensitive data can be exposed with serious impact
  • Other systems: Data changes High Protected data can be changed with serious impact
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source