CVE-2026-88009: Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 2.11.57 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.7.13
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Traefik deployments running versions earlier than 2.11.57 or 3.7.13 are affected when they accept HTTP/1 requests and forward requests to a backend that interprets an opaque request target as a path.
What does an attacker need to send?
An attacker needs to submit an HTTP/1 request with a rootless request target. Traefik evaluates the request as though its path were "/", while forwarding the opaque target verbatim to the backend.
How can I determine whether an instance needs remediation?
Check the deployed Traefik version. Instances on the 2.11 release line need to be updated to 2.11.57 or later, and instances on the 3.7 release line need to be updated to 3.7.13 or later.
What is the impact if a vulnerable request reaches a compatible backend?
The request can bypass path-scoped routing and authorization controls, including middleware guards such as forwardAuth. Access logging can record the normalized "/" path rather than the path interpreted by the backend.