DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88004: CVE-2026-88004: Security Bypass in Traefik Entrypoint Protections via Smuggled Request Trailers

#security #cve #cybersecurity

CVE-2026-88004: Security Bypass in Traefik Entrypoint Protections via Smuggled Request Trailers

Vulnerability ID: CVE-2026-88004
CVSS Score: 7.0
Published: 2026-09-10

An interpretation conflict and security bypass vulnerability in the entrypoint security mechanisms of Traefik allows unauthenticated remote attackers to bypass header-name sanitization and strip/reject policies. By smuggling sensitive, protected, or trusted header names inside an HTTP/1.1 chunked trailer or an HTTP/2 trailer, attackers can bypass Traefik's security defenses if a downstream backend merges trailers into the header namespace.

TL;DR

Unauthenticated attackers can bypass Traefik's entrypoint header filters (like X-Forwarded-For stripping) by smuggling security-sensitive headers in HTTP trailers. When Traefik's buffering or retry middlewares parse the request, the trailer values bypass sanitization and are forwarded to backends, which may trust and process them as authenticated headers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-436 / CWE-807
  • Attack Vector: Network
  • CVSS v4.0 Score: 7.0 (High)
  • Exploit Status: poc
  • CISA KEV Status: Not Listed
  • Patch Status: Patched in v3.7.13

Affected Systems

  • Traefik deployments with buffering or retry middlewares enabled
  • Traefik: >= 3.2.0, < 3.7.13 (Fixed in: v3.7.13)

Code Analysis

Commit: 55bbda4

Forward request trailer names without their values

for name := range pr.Out.Trailer {
    pr.Out.Trailer[name] = nil
}
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade Traefik to version v3.7.13 or higher.
  • Disable trailer merging on downstream backend application servers.
  • Avoid presence-based authentication filters on downstream backends.
  • Implement WAF rules to drop anomalous Trailer fields in incoming requests.

Remediation Steps:

  1. Identify all Traefik instances using version >= 3.2.0 and < 3.7.13.
  2. Update deployment manifests or configuration files to reference image tag v3.7.13.
  3. Deploy the updated configuration to production clusters.
  4. Audit downstream backend services to ensure they do not merge trailer metadata into HTTP headers.

References

Read the full report for CVE-2026-88004 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)