CVE-2026-88008

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88008
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-88008.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-88008
Aliases
Downstream
CGA (6)
MINI (3)
openSUSE (2)
SUSE (2)
Related
openSUSE (2)
SUSE (2)
Published
2026-09-10T14:57:06Z
Modified
2026-10-22T10:32:38Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Details

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-444",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88008.json"
}
References

Affected packages

Git / github.com/traefik/traefik

Affected ranges

Type
GIT
Repo
https://github.com/traefik/traefik
Events
Introduced
8ae0379171cd04b60d7a1cb7da124ef56e8fc9f1
Fixed
839eb7f48a16849f22762b7e3bdfc58253146cd7
Introduced
a51918066548a919cf8d46c8c5193cd5ab52a999
Fixed
fc92cc118a0557a029c7019d5ee06665127b0f13
Fixed
a277e94664ffc1ce9543df552d3bbf48d4d3b8b3
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.11.26"
                },
                {
                    "fixed": "2.11.57"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.2"
                },
                {
                    "fixed": "3.7.13"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "a277e94664ffc1ce9543df552d3bbf48d4d3b8b3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.11.57",
            "range": [
                {
                    "fixed": "839eb7f48a16849f22762b7e3bdfc58253146cd7"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v3.7.13",
            "range": [
                {
                    "fixed": "fc92cc118a0557a029c7019d5ee06665127b0f13"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*
v2.11.26
v2.11.27
v2.11.28
v2.11.29
v2.11.30
v2.11.31
v2.11.32
v2.11.33
v2.11.34
v2.11.35
v2.11.36
v2.11.37
v2.11.38
v2.11.39
v2.11.40
v2.11.41
v2.11.42
v2.11.43
v2.11.44
v2.11.45
v2.11.46
v2.11.47
v2.11.48
v2.11.49
v2.11.50
v2.11.51
v2.11.52
v2.11.53
v2.11.54
v2.11.55
v2.11.56

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-88008.json"