DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88009: CVE-2026-88009: HTTP Request Smuggling and Authorization Bypass via Opaque Target Processing in Traefik

#security #cve #cybersecurity

CVE-2026-88009: HTTP Request Smuggling and Authorization Bypass via Opaque Target Processing in Traefik

Vulnerability ID: CVE-2026-88009
CVSS Score: 8.8
Published: 2026-09-10

An architectural parser-differential vulnerability in Traefik's routing engine allows unauthenticated attackers to bypass path-based routing rules, authentication middleware, and access logs. The issue stems from inconsistencies in handling rootless/opaque request targets between Go's standard net/http parser and Traefik's internal routing and sanitization layers. This vulnerability compromises the authorization boundary of upstream microservices.

TL;DR

A parser differential between Go's HTTP parser and lenient backend servers allows attackers to smuggle requests, bypass Traefik's path-scoped middleware (such as authentication), and access administrative endpoints undetected.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-444
  • Attack Vector: Network (AV:N)
  • CVSS Base Score: 8.8 (High)
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed
  • Affected Component: Core Entrypoint Routing Engine

Affected Systems

  • Traefik
  • Traefik: < 2.11.57 (Fixed in: 2.11.57)
  • Traefik: >= 3.0.0, < 3.7.13 (Fixed in: 3.7.13)

Code Analysis

Commit: 58d1e9c

Deny request with an opaque request target

Mitigation Strategies

  • Upgrade to Traefik v2.11.57 or v3.7.13
  • Implement Web Application Firewall (WAF) filtering for rootless URI patterns
  • Apply IDS/IPS rules to detect raw absolute-form URI schemes
  • Deploy strict HTTP parsing configurations on downstream backend microservices

Remediation Steps:

  1. Identify all running instances of Traefik within the infrastructure environment
  2. Check running versions against the vulnerable version list (< 2.11.57 or >= 3.0.0, < 3.7.13)
  3. Update container images or deployment binaries to version 2.11.57 or 3.7.13
  4. Restart Traefik instances and verify the entrypoint rejects test payloads with a 400 Bad Request response

References

Read the full report for CVE-2026-88009 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)