CVE-2026-88008: Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Published Sep 10, 2026
·
Updated

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.

Affected Software

1 affected component
Traefik Labs Traefik>=2.11.26<2.11.57, =3.7.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Traefik to a version that resolves this vulnerability.

    Fixed in 2.11.57
  2. Upgrade

    Upgrade Traefik to a version that resolves this vulnerability.

    Fixed in 3.7.13

Event History

Sep 10, 2026
CVE Published
via MITRE·02:57 PM
Data Sourced
via MITRE·02:57 PM
DescriptionWeakness

Frequently Asked Questions

1

Which deployments are exposed to this issue?

Deployments are exposed when Traefik forwards traffic to a shared backend that accepts h2c upgrades, and that backend serves both an unprotected route and protected paths. An unauthenticated client must be able to reach the unprotected route through Traefik.

2

What does an attacker need to do to bypass protections?

The attacker sends a client-supplied Connection header requesting Upgrade, along with Upgrade: h2c and HTTP2-Settings, to trigger an h2c upgrade accepted by the backend. After the backend returns 101 Switching Protocols, later HTTP/2 requests in the raw tunnel can reach protected paths on that backend.

3

Which Traefik controls can be bypassed after a successful upgrade?

Traefik no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to subsequent HTTP/2 requests in the tunnel. This can permit unauthenticated access to paths that would ordinarily be protected by those controls.

4

What versions contain the fix?

The issue is fixed in Traefik 2.11.57 and 3.7.13. Affected versions include releases from 2.11.26 until 2.11.57, and 3.7.13 is identified as affected in the provided advisory data.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203