Authentication Bypass Vulnerability in Traefik HTTP Proxy and Load Balancer

CVE-2026-88007

What is CVE-2026-88007?

Traefik, a widely used open-source HTTP reverse proxy and load balancer, contains a vulnerability that affects versions 2.11.0 through 2.11.57 and 3.7.13. The issue occurs within the HTTP/3 entrypoint ConnContext, where the necessary transport for each frontend connection is not established. Consequently, a shared backend transport is used, allowing an unrelated client to exploit this lack of isolation. This leads to potential unauthorized access to data belonging to victims who are using connection-bound NTLM or Negotiate authentication. With the backend keep-alive feature enabled, attackers could successfully impersonate victims without their credentials. Users are strongly advised to upgrade to the fixed versions 2.11.57 or 3.7.13 to mitigate this risk.

References