CVE-2026-88007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88007
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-88007.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-88007
Aliases
Downstream
CGA (6)
MINI (3)
openSUSE (1)
SUSE (2)
Related
openSUSE (1)
SUSE (2)
Published
2026-09-10T14:47:28Z
Modified
2026-09-27T18:26:37Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Traefik HTTP/3 Backend NTLM Connection Reuse
Details

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-287",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88007.json"
}
References

Affected packages

Git / github.com/traefik/traefik

Affected ranges

Type
GIT
Repo
https://github.com/traefik/traefik
Events
Introduced
23c26d64eeb72eaecaecedc31ca740e83304fde2
Fixed
d87731461f0c7beb6fdbcc5a5655a44ce56e537a
Introduced
d99d2f95e66a28ee8180634dc80fdf13ba68c62a
Fixed
e8f398ee30ca5643158ea9094b701b8eae9849e5
Fixed
ff39c47d7459dec9cd8de63c1a4e7aa7315bdc1c
Fixed
839eb7f48a16849f22762b7e3bdfc58253146cd7
Fixed
fc92cc118a0557a029c7019d5ee06665127b0f13
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.8.2"
        },
        {
            "fixed": "2.11.56"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.7.12"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-88007.json"