CVE-2026-88008 in Traefik
Summary
by MITRE • 09/10/2026
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
Traefik serves as a widely adopted open-source HTTP reverse proxy and load balancer, designed to manage traffic routing for modern microservices architectures. A critical security flaw was identified within versions ranging from 2.11.26 up to but not including 2.11.57, as well as in version 3.7.13 prior to its patching release. This vulnerability stems from the proxy's handling of HTTP protocol upgrades, specifically when a client requests an upgrade to HTTP/2 cleartext (h2c) via the Connection header and Upgrade token. The core technical flaw lies in Traefik’s decision to establish a raw tunnel with the backend server upon receiving a successful 101 Switching Protocols response from that backend. Once this tunnel is established, Traefik ceases to process subsequent HTTP/2 requests through its standard middleware pipeline. This architectural shift effectively bypasses all security controls and observability features configured for those routes, including Basic Authentication, ForwardAuth mechanisms, IP allow lists, rate limiting policies, access logging, metrics collection, and distributed tracing capabilities.
The operational impact of this vulnerability is severe, as it allows an unauthenticated attacker to circumvent authentication and authorization checks entirely. By exploiting the h2c upgrade mechanism, a malicious actor can send requests directly to protected paths on the backend server that would normally be restricted by Traefik’s middleware stack. For instance, if a specific route requires BasicAuth or IP-based restrictions, these controls are rendered ineffective for any traffic flowing through this raw tunnel. This creates an unauthorized access vector where sensitive endpoints become reachable without valid credentials or proper network filtering. Furthermore, the bypass of logging and tracing mechanisms means that such intrusions may go undetected by standard monitoring tools, complicating incident response and forensic analysis efforts. The vulnerability essentially transforms a secured reverse proxy into an unfiltered conduit for specific types of traffic, undermining the security posture intended by the system administrator.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control, as it involves bypassing established access control mechanisms through protocol manipulation. It also relates to CWE-693 Protection Mechanism Bypass, specifically where the protection mechanism (Traefik’s middleware) is circumvented by exploiting the transition between different HTTP versions and connection states. In terms of offensive security frameworks, this behavior can be mapped to MITRE ATT&CK technique T1071 Application Layer Protocol, as it involves abusing a legitimate protocol feature for unauthorized access. The attack vector leverages the trust placed in the backend server’s acceptance of an upgrade request, assuming that once upgraded, the proxy will continue to enforce its policies, which is not the case due to the switch to raw tunneling mode.
To mitigate this vulnerability, organizations running affected versions of Traefik must immediately update their infrastructure to version 2.11.57 or later for the v2 series, and version 3.7.13 or later for the v3 series. These releases contain patches that prevent the proxy from entering a raw tunnel state without properly applying middleware rules even after an upgrade request is processed. In addition to upgrading, administrators should review their Traefik configurations to ensure that critical security middlewares are applied consistently across all entry points and routers. It is also advisable to implement defense-in-depth strategies by placing additional authentication or filtering layers at the backend service level itself, rather than relying solely on the reverse proxy for access control. Regularly auditing middleware chains and ensuring they remain active regardless of connection state changes will further harden the deployment against similar protocol-level bypass attempts in the future.