CVE-2026-88004 in Traefik
Summary
by MITRE • 09/10/2026
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted header name in an HTTP/1.1 chunked trailer or an HTTP/2 trailer. When the retry or buffering middleware reads the body before the reverse proxy clones the request, the attacker-controlled trailer value reaches a backend that merges trailers into the header namespace, bypassing the documented delete or reject behavior and potentially spoofing identity or forwarded routing data. This issue is fixed in 3.7.13.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
Traefik serves as a widely deployed open-source HTTP reverse proxy and load balancer designed to manage traffic flow across distributed systems. In versions ranging from 3.2.0 through 3.7.13, the software contains a critical input validation flaw within its entrypoint defense mechanisms. Specifically, the aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders configuration options are intended to sanitize incoming requests by inspecting header names for potentially dangerous patterns such as aliases or underscores that could lead to request smuggling or identity spoofing. However, these security controls were implemented with a narrow scope that exclusively examined the req.Header collection while neglecting the req.Trailer field. This oversight creates a significant gap in the defense-in-depth architecture of the proxy, allowing attackers to bypass header filtering rules by utilizing HTTP trailers rather than standard headers.
The technical root cause lies in the structural differences between how HTTP/1.1 and HTTP/2 handle trailing metadata. In HTTP/1.1 chunked transfer encoding, as well natively in HTTP/2, data can be appended after the main body of a request in the form of trailers. These trailers are technically distinct from headers but often share similar semantic meanings regarding routing or authentication context. Because Traefik's middleware logic did not extend its inspection routines to include req.Trailer, an unauthenticated client could craft requests containing malicious header names within these trailer sections. When such a request is processed by middlewares like retry or buffering that consume the body before the reverse proxy clones and forwards the request, the attacker-controlled trailer values are effectively hidden from the initial security checks.
The operational impact of this vulnerability is severe due to how backend servers typically process incoming data. Many backend applications merge HTTP trailers into their header namespace during parsing, treating them identically to standard headers for routing or authentication decisions. Consequently, an attacker can inject aliasing or trusted header names via trailers that bypass the proxy's filtering rules and reach the backend application directly. This allows for potential identity spoofing, where an attacker might impersonate a legitimate user by injecting forged authorization tokens or X-Forwarded-For addresses into the trailer section. It also enables routing manipulation, potentially directing traffic to unintended backends or disrupting load balancing logic based on manipulated header values that were not subject to the configured deny lists.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method or Function in terms of failing to validate all input vectors. From a threat modeling perspective, it relates to MITRE ATT&CK techniques involving Request Smuggling and Header Injection, as the attacker exploits protocol-level features to evade security controls. The issue highlights the complexity of handling HTTP/2 trailers versus HTTP/1.1 chunked encodings in reverse proxy implementations, where inconsistent validation across different parts of the request object can lead to privilege escalation or data integrity compromises.
To mitigate this risk, organizations running Traefik versions prior to 3.7.13 must upgrade immediately to version 3.7.13 or later, which includes patches that extend header inspection logic to cover trailer fields as well. Until the update is applied, administrators should consider implementing additional WAF rules at a network perimeter device if available, though this may not fully mitigate protocol-specific trailer injection attacks. It is also advisable to review backend application configurations to ensure they do not blindly merge trailers into headers without validation, although relying solely on backend defenses is insufficient given that the proxy itself failed to filter malicious inputs initially. Regular audits of reverse proxy configurations against evolving HTTP standards are recommended to prevent similar oversights in future deployments.