CVE-2026-88007
Traefik, an open‑source HTTP reverse proxy, had a flaw that let attackers reuse authenticated connections when HTTP/3 was enabled. The bug allowed an attacker to read data meant for another user and impersonate that user without knowing their credentials. The issue is fixed in newer releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Traefik versions 2.11.0 through 2.11.56 and 3.7.0 through 3.7.12. Users running those versions with HTTP/3 enabled and a backend that uses NTLM or Negotiate authentication are affected.
Real-world impact
An attacker can hijack a backend connection that has already been authenticated for a victim, read data that only the victim should see, and perform actions as that victim, all without needing the victim’s credentials.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability can be exploited remotely over the network, requires no user interaction, and gives an attacker full confidentiality and integrity compromise of victim data. The lack of authentication and the high impact on confidentiality and integrity drive the score to critical.
What to do about it
- 011. Verify your current Traefik version.
- 022. Upgrade to Traefik 2.11.57 or later, or 3.7.13 or later.
- 033. Restart the Traefik service to apply the update.
NVD-referenced vendor advisory
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.