DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88007: CVE-2026-88007: Connection Hijacking and Unauthorized Session Reuse in Traefik HTTP/3 Proxying

#security #cve #cybersecurity

CVE-2026-88007: Connection Hijacking and Unauthorized Session Reuse in Traefik HTTP/3 Proxying

Vulnerability ID: CVE-2026-88007
CVSS Score: 9.1
Published: 2026-09-10

CVE-2026-88007 is a critical vulnerability in Traefik where connection-bound backend authentication (like NTLM or Kerberos) is compromised over HTTP/3. Due to an uninitialized connection transport context, authenticated TCP sockets from a victim are leaked into a globally shared pool and subsequently reused by unrelated clients, leading to unauthenticated session hijacking.

TL;DR

Unauthenticated remote session hijacking via backend connection reuse over HTTP/3 in Traefik v2.11.x (< 2.11.57) and v3.x (< 3.7.13) when using connection-bound auth (NTLM/Negotiate).

Technical Details

  • CWE ID: CWE-287, CWE-863
  • Attack Vector: Network
  • CVSS v4.0 Score: 9.1
  • Impact: Session Hijacking / Unauthorized Data Access
  • Exploit Status: none
  • KEV Status: Not Listed

Affected Systems

  • Traefik HTTP/3 Entrypoints proxied to connection-bound authenticated backends (NTLM/Negotiate)
  • Traefik: >= 2.11.0, < 2.11.57 (Fixed in: 2.11.57)
  • Traefik: >= 3.0.0, < 3.7.13 (Fixed in: 3.7.13)

Code Analysis

Commit: ff39c47

Fix connection context setup in HTTP/3 entrypoints to prevent sharing of connection-bound backend transports (NTLM/Negotiate), and fix case-insensitive match for WWW-Authenticate scheme.

Mitigation Strategies

  • Disable HTTP/3 on Traefik entrypoints
  • Disable keep-alives on backend servers
  • Migrate from connection-bound authentication (NTLM/Negotiate) to token-based protocols (OIDC, SAML)

Remediation Steps:

  1. Verify Traefik version running on active deployment environments
  2. Update Traefik to version 2.11.57 or 3.7.13 depending on current major version
  3. Verify HTTP/3 functionality and connection-bound backend routing after upgrade
  4. Implement integration tests checking for connection isolation across multiple simulated HTTP/3 sessions

References

Read the full report for CVE-2026-88007 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)