CVE-2026-88007 in Traefik
Summary
by MITRE • 09/10/2026
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
Traefik serves as a widely adopted open-source HTTP reverse proxy and load balancer designed to manage traffic flow between clients and backend services. In versions ranging from 2.11.0 through 2.11.57, and specifically within the 3.x series up to version 3.7.13, a critical architectural flaw exists in how HTTP/3 connections are handled regarding context propagation for authentication transports. The vulnerability stems from the failure of the HTTP/3 entrypoint ConnContext to invoke service.AddTransportOnContext during connection initialization. This omission results in a significant deviation from the intended security model where each frontend connection should maintain its own isolated transport layer, particularly when dealing with stateful or connection-bound authentication mechanisms such as NTLM and Negotiate protocols.
The technical core of this vulnerability lies in the sharing of backend transports across multiple unrelated client connections. When HTTP/3 is enabled on an entrypoint that utilizes a backend service configured for keep-alive connections combined with Kerberos, NTLM, or Negotiate authentication, the system incorrectly reuses a single shared transport instance rather than allocating distinct transports per frontend connection. This design flaw allows sessions to bleed across different client identities because the underlying HTTP/3 implementation does not properly isolate the context required to bind specific credentials to specific network connections. Consequently, the proxy fails to enforce strict session boundaries that are essential for maintaining authentication integrity in modern web architectures.
The operational impact of this misconfiguration is severe and directly facilitates unauthorized access through connection reuse attacks. An attacker who establishes a connection to the Traefik instance can exploit the shared transport mechanism to piggyback on an existing backend connection that was authenticated by another user, referred to as the victim. Since NTLM and Negotiate protocols often rely on the continuity of TCP or QUIC connections for their challenge-response sequences, the proxy's failure to isolate these contexts allows the attacker to read data intended exclusively for the victim without possessing the victim’s credentials. This effectively bypasses authentication controls, enabling an unrelated client to act as a legitimate user and access sensitive resources that should be restricted by identity verification.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in managing session identifiers or connection contexts that lead to privilege escalation via object reuse. From the perspective of the MITRE ATT&CK framework, this behavior is consistent with techniques involving Session Sidejacking and Credential Reuse, where an adversary leverages existing authenticated sessions to gain unauthorized access without needing to crack passwords or exploit additional software flaws in the backend application itself. The lack of proper context isolation represents a fundamental breakdown in the principle of least privilege within the proxy’s connection management layer.
To mitigate this risk, organizations running affected versions must upgrade Traefik immediately to version 2.11.57 or later for the v2 series, and version 3.7.13 or later for the v3 series. These releases contain the necessary code changes to ensure that service.AddTransportOnContext is correctly invoked within the HTTP/3 entrypoint ConnContext, thereby restoring proper isolation of backend transports per frontend connection. Until an upgrade can be performed, administrators should consider disabling HTTP/3 on entrypoints that proxy traffic requiring NTLM or Negotiate authentication as a temporary workaround, although upgrading remains the only definitive resolution to address this architectural deficiency in session management and access control enforcement.