CVE-2026-88008: Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 2.11.57 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.7.13
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when Traefik forwards traffic to a shared backend that accepts h2c upgrades, and that backend serves both an unprotected route and protected paths. An unauthenticated client must be able to reach the unprotected route through Traefik.
What does an attacker need to do to bypass protections?
The attacker sends a client-supplied Connection header requesting Upgrade, along with Upgrade: h2c and HTTP2-Settings, to trigger an h2c upgrade accepted by the backend. After the backend returns 101 Switching Protocols, later HTTP/2 requests in the raw tunnel can reach protected paths on that backend.
Which Traefik controls can be bypassed after a successful upgrade?
Traefik no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to subsequent HTTP/2 requests in the tunnel. This can permit unauthenticated access to paths that would ordinarily be protected by those controls.
What versions contain the fix?
The issue is fixed in Traefik 2.11.57 and 3.7.13. Affected versions include releases from 2.11.26 until 2.11.57, and 3.7.13 is identified as affected in the provided advisory data.