CVE-2026-88009 in Traefik
Summary
by MITRE • 09/10/2026
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
Traefik serves as a widely deployed open-source HTTP reverse proxy and load balancer, facilitating traffic routing between clients and backend services based on configurable rules. A critical architectural flaw was identified in versions prior to 2.11.57 and 3.7.13 regarding the handling of rootless HTTP/1 request targets. In these vulnerable iterations, when a client submits an HTTP/1 request with a target that lacks a leading slash or is otherwise considered rootless by Go's standard library, the underlying URL structure stores this value in the Opaque field while leaving the Path field empty. This discrepancy creates a divergence between how Traefik processes routing logic and how it forwards requests to upstream services.
The core technical vulnerability lies within the rewriteRequestBuilder function, which is responsible for preparing incoming requests for backend transmission. During the evaluation phase, Traefik normalizes the request path to a root slash character when determining routing rules, performing path sanitization checks, evaluating forward authentication requirements, processing encoded characters, and generating access logs based on this normalized state. However, during the actual forwarding stage, instead of using the sanitized or normalized path for transmission, the proxy forwards the raw URL.Opaque value verbatim to the backend server. This behavior assumes that backends will interpret the opaque target as a standard URI path, which is not always guaranteed and leads to inconsistent security enforcement across different layers of the request lifecycle.
This architectural inconsistency results in severe operational impacts, primarily manifesting as cross-vhost routing bypasses and path-scoped authorization failures. Because access control decisions such as forwardAuth are made against the normalized root path rather than the actual forwarded content, an attacker can craft requests that satisfy authentication checks for a protected resource while being routed to or interpreted by the backend in a manner that circumvents those same controls. For instance, if a security policy restricts access to specific sub-paths within a virtual host, an attacker could exploit this discrepancy to bypass path-scoped authorization rules entirely. Furthermore, because logging mechanisms rely on the normalized view of the request rather than the actual transmitted payload, malicious activities may go undetected in audit trails, leading to significant gaps in visibility and forensic analysis capabilities for security operations teams.
The vulnerability aligns with CWE-284 Improper Access Control, as it allows unauthorized access through flawed enforcement mechanisms, and CWE-798 Use of Hard-coded Credentials if the bypass leads to authentication evasion. From an offensive perspective, this flaw maps to ATT&CK technique T1071 Application Layer Protocol, specifically involving web protocols like HTTP where attackers manipulate protocol parsing differences between intermediaries and endpoints to evade detection or access controls. The issue is fundamentally a logic error in request transformation that exploits the gap between internal routing metadata and external transmission data.
To mitigate this risk, organizations running Traefik must upgrade immediately to version 2.11.57 or later for the v2 series, or version 3.7.13 and later for the v3 series. These releases correct the handling of rootless request targets by ensuring that path normalization is consistently applied during both decision-making and forwarding phases. Until an upgrade can be performed, administrators should consider implementing additional validation at a network perimeter device such as a Web Application Firewall to inspect raw HTTP requests for anomalous target formats before they reach the Traefik instance. Additionally, reviewing access logs against backend server logs may help identify potential exploitation attempts that evaded standard logging mechanisms due to this discrepancy.