Unauthorized Access Vulnerability in Traefik Reverse Proxy by Traefik Labs

CVE-2026-88008

What is CVE-2026-88008?

The Traefik reverse proxy is susceptible to a significant vulnerability that allows unauthorized requests to access protected routes. Specifically, between versions 2.11.26 and 2.11.57, as well as 3.7.13, Traefik improperly handles client-supplied Connection headers. If a backend service accepts the h2c protocol and responds with a 101 Switching Protocols status, Traefik fails to apply necessary security features such as authentication and access logging. This lapse can result in exposure of sensitive resources to unauthenticated users. The issue has been resolved in versions 2.11.57 and 3.7.13.

References