CVE-2026-88009CWE-1286CWE-444

CVE-2026-88009

High · published September 10, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00443 · 37.5th percentile
Weaknesses
CWE-1286 · Improper Validation of Syntactic Correctness of Input; CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-09-10T20:18Z
Affected products (2)
ProductVersionsFixed in
traefik/traefik< 2.11.572.11.57
traefik/traefik≥ 3.0.0, < 3.7.133.7.13
References (5)
https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9 · [email protected]https://github.com/traefik/traefik/pull/13796 · [email protected]https://github.com/traefik/traefik/releases/tag/v2.11.57 · [email protected]https://github.com/traefik/traefik/releases/tag/v3.7.13 · [email protected]https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724 · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 15:01Z
    Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
    cvelistv5