Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
Published: 2026-09-10
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to Protected Paths
Action: Immediate Patch
AI Analysis

Impact

Traefik, the widely used open‑source reverse proxy and load balancer, had an inconsistency in how it processed client‑supplied Connection headers that request a protocol upgrade to HTTP/2 (h2c). When a backend accepts the upgrade and replies with a 101 Switching Protocols, Traefik switches to a raw tunnel mode. In this mode the proxy stops applying any of its routing, authentication, rate‑limiting, logging, metrics, or tracing rules to subsequent HTTP/2 requests. Consequently a client can transit through the proxy to a protected route on a backend that would normally be guarded, effectively bypassing all configured authorisation checks.

Affected Systems

Traefik releases from version 2.11.26 through 2.11.57 and the parallel 3.7.13 version are vulnerable. The issue is fixed in Traefik 2.11.57, 3.7.13 and later releases. Verify the exact version in use; if it falls within the affected range, the vulnerability applies.

Risk and Exploitability

The CVSS score of 7.0 denotes high severity. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability requires only network access and an HTTP request containing a Connection: Upgrade header with the h2c token and an HTTP2‑Settings field. No local privileges are necessary. The vulnerability is not listed in the CISA KEV catalog, but the straightforward attack path and high impact warrant immediate remediation.

Generated by OpenCVE AI on September 23, 2026 at 01:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Traefik to version 2.11.57, 3.7.13, or later to apply the upstream fix for HTTP/2 upgrade handling.
  • If an upgrade cannot be performed immediately, configure the ingress, firewall, or upstream router to strip or block client‑supplied Upgrade and HTTP2‑Settings headers before forwarding traffic to backends that do not explicitly support h2c.
  • For environments that must maintain h2c upgrades to backends, ensure that each backend enforces its own authentication, rate‑limiting, and access controls so that a tunnel bypass cannot reach protected resources.

Generated by OpenCVE AI on September 23, 2026 at 01:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-w4v4-9rw7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
History

Wed, 23 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-358
References
Metrics threat_severity

None

 threat_severity

Critical

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Fri, 11 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Traefik
Traefik traefik
Vendors & Products Traefik
Traefik traefik

Thu, 10 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Description Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
Title Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Weaknesses CWE-444
CWE-863
References
Metrics cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Traefik Traefik
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-10T16:56:53.731Z

Reserved: 2026-09-09T19:19:27.406Z

Link: CVE-2026-88008

cve-icon Vulnrichment

Updated: 2026-09-10T16:55:45.619Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-10T15:17:56.433

Modified: 2026-09-14T19:59:04.550

Link: CVE-2026-88008

cve-icon Redhat

Severity : Critical

Publid Date: 2026-09-10T14:57:06Z

Links: CVE-2026-88008 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T02:00:10Z

Weaknesses
  • CWE-358

    Improperly Implemented Security Check for Standard

  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

  • CWE-863

    Incorrect Authorization