DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88008: CVE-2026-88008: Middleware Security Bypass via Unencrypted HTTP/2 (h2c) Connection Upgrades in Traefik

#security #cve #cybersecurity

CVE-2026-88008: Middleware Security Bypass via Unencrypted HTTP/2 (h2c) Connection Upgrades in Traefik

Vulnerability ID: CVE-2026-88008
CVSS Score: 7.0
Published: 2026-09-10

An architectural flaw in the Traefik reverse proxy allows unauthenticated remote attackers to bypass security middlewares (such as basic authentication, IP allowlists, and forward authorization) by initiating an unencrypted HTTP/2 (h2c) upgrade request, causing the proxy to transition the connection into an opaque bi-directional TCP tunnel.

TL;DR

Unauthenticated remote attackers can bypass Traefik security middlewares by upgrading a connection to cleartext HTTP/2 (h2c) over an unrestricted route, establishing a raw TCP tunnel directly to the backend that allows uninspected multiplexed streams to reach private paths.

Technical Details

  • CWE ID: CWE-444 / CWE-863
  • Attack Vector: Network (N)
  • CVSS v4.0 Score: 7.0 (High)
  • EPSS Score: 0.00 (Pending)
  • Impact: Authentication & Middleware Policy Bypass
  • Exploit Status: Proof-of-Concept State
  • CISA KEV Status: Not Listed

Affected Systems

  • Traefik Proxy
  • Traefik: >= 2.11.26, < 2.11.57 (Fixed in: 2.11.57)
  • Traefik: >= 3.4.2, < 3.7.13 (Fixed in: 3.7.13)

Code Analysis

Commit: a277e94

Introduce h2cUpgradeHandler to strip client-initiated h2c upgrades and prevent reverse proxy tunneling bypass.

Mitigation Strategies

  • Upgrade Traefik to non-vulnerable release versions (v2.11.57 or v3.7.13)
  • Disable cleartext h2c upgrade support on all backend destination servers
  • Configure unencrypted backend endpoints using prior knowledge (h2c:// scheme) rather than transport upgrades

Remediation Steps:

  1. Audit existing deployment files to check Traefik dynamic and static configuration structures.
  2. Upgrade Traefik binary or Docker container image tag to 2.11.57 or 3.7.13.
  3. Verify configuration files do not expose h2c backends using http:// schemas if h2c is enabled at the service layer.
  4. Test endpoint compliance by sending a mock h2c upgrade request and ensuring the Upgrade header is excluded.

References

Read the full report for CVE-2026-88008 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)