CVE-2026-71324
Description
A flaw was found in Traefik. Traefik's HTTP reverse proxy can improperly handle HTTP/2 or HTTP/3 CONNECT requests forwarded to an HTTP/1.1 upstream. If the upstream sends a keep-alive non-2xx response and does not fully drain the body, the desynchronized backend socket is returned to a shared pool. An unauthenticated attacker can exploit this by making a different client read their smuggled response, which can lead to information disclosure, potentially exposing authenticated or private content from other requests. The ForwardAuth middleware can also be affected, further exposing the authentication client pool to desynchronization.
Statement
A desynchronization flaw in Traefik's HTTP reverse proxy allows an unauthenticated remote attacker to perform HTTP request smuggling. When forwarding HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream that responds with a keep-alive non-2xx status without draining the request body, Traefik re-adds the tainted connection to its shared transport pool. Subsequent requests from other clients reused on this socket read the attacker's smuggled response, leading to cross-tenant data leakage or exposed authentication credentials, bypassing non-root container boundaries.
Mitigation
To mitigate this flaw, disable HTTP/2 and HTTP/3 CONNECT request handling at the ingress layer if not required. Alternatively, configure upstream HTTP/1.1 services to forcefully close connections (`Connection: close`) upon returning non-2xx status codes to prevent socket pooling.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.6 | 9.1 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Changed | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | None | High | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
