Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing

Published September 10, 2026 CVE-2026-88009

Traefik can send protected backend paths through the wrong route. An attacker may bypass path-based access controls and hide the request from access logs.

Severity
HighCVSS 4.0 · 8.8
Fix
Fixed in 2.11.57Fix recorded today
Affected versions
before 2.11.57; 3.0.0 or newer, but before 3.7.13
Weakness
CWE-444HTTP Request Smuggling
Exploit likelihood
0.34% in 30 daysEPSS, higher than 26% of known flaws
Affects
Traefik

How it works

  • An unauthenticated attacker sends a specially formed HTTP/1 request target.
  • Traefik treats its path as / while forwarding the original target to the backend.
  • Path-based routing, authorization checks, and logging therefore inspect the wrong path.
  • The backend may then serve a protected path or different virtual host.

What to do

Check the running Traefik version and compare it with the affected ranges in the Traefik advisory. Versions below 2.11.57 and versions 3.0.0 through 3.7.12 are affected.

Upgrade Traefik 2.x to 2.11.57 or later, or upgrade Traefik 3.x to 3.7.13 or later. Traefik 3.0 through 3.6 users must move to the 3.7.13 release line.

Technical details

Traefik is an open-source HTTP reverse proxy and load balancer. The flaw creates inconsistent request interpretation between Traefik and its backend, enabling cross-vhost routing, path-scoped authorization bypass, and access-log evasion.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes Low Some data can be modified
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source