CVE-2026-88877
Traefik, a popular HTTP reverse proxy and load balancer, has a critical flaw in versions 3.7.0 through 3.7.11. When an Ingress uses both an authentication annotation and the from‑to‑www‑redirect annotation, Traefik creates a hidden router that bypasses authentication and other middle‑ware. Updating to version 3.7.12 or later removes the vulnerability.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Traefik reverse proxy and load balancer, specifically releases v3.7.0 to v3.7.11 inclusive. Earlier Traefik v2 and v3 releases before v3.7.0 are not affected.
Real-world impact
An attacker can craft a request with a non‑numeric or empty port (e.g., 'Host: www.example.com:x') that is routed to the protected backend without any authentication or IP‑allowlisting applied, effectively gaining unauthorized access to services behind Traefik.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high impact: it allows an attacker to bypass authentication and other security controls (confidentiality, integrity, availability) with no user interaction or special privileges, making it a critical risk for exposed services.
What to do about it
- 011. Upgrade Traefik to version 3.7.12 or later.
- 022. Restart the Traefik service to apply the new configuration.
NVD-referenced vendor advisory
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.