CVE-2026-88009
Description
A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. This vulnerability allows a remote attacker to bypass security controls by sending a specially crafted HTTP/1 request. The request target is incorrectly processed, leading to cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion. This can occur when the backend server interprets the opaque request target as a valid path.
Statement
A flaw was found in Traefik's HTTP/1 request handling. Prior to versions 2.11.57 and 3.7.13, Traefik processes rootless HTTP/1 request targets by storing them in Go's URL.Opaque field while leaving URL.Path empty. During request processing, the rewriteRequestBuilder path normalizes the routing, path-scoped authorization, forwardAuth, and access logging paths to "/" while forwarding the original opaque target verbatim to the backend. A remote, unauthenticated attacker can craft requests with rootless HTTP/1 targets to bypass cross-vhost routing rules, path-scoped access controls, and access logging when the backend interprets the opaque string as a valid path.
Mitigation
There is no effective configuration-level or path-sanitization mitigation within Traefik to resolve this issue, as request normalization occurs prior to routing and forwarding decisions. System administrators should upgrade Traefik to version 2.11.57, 3.7.13, or later, or deploy an upstream reverse proxy to sanitize or reject HTTP/1 requests containing rootless or opaque request targets before they reach Traefik.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.2 | 8.2 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | Low | Low | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
