CVE-2026-88009GHSA-f52w-8j3h-j724GO-2026-6465

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

traefik traefikGoLibraries & packages

CVSS

8.8High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.44%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 24 Oct 2026FIRST EPSS

Fixed in3.7.13Also 2.11.57OSV

Published10 Sep 2026Updated 17 Sep 2026CVE List

What fixes it

3.7.13github.com/traefik/traefik/v3, GoOSVgo get github.com/traefik/traefik/v3@v3.7.13
2.11.57github.com/traefik/traefik/v2, GoOSVgo get github.com/traefik/traefik/v2@v2.11.57

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

10 Sep 2026, 15:01 UTCPublishedCVE List
25 Oct 2026, 00:02 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Boreas37/CVE-2026-88009-PoC: CVE-2026-88009 — Traefik forwards a rootless opaque request target that routing/forwardAuth see as '/'. Auth bypass + access-log evasion, verified v3.7.10 / v3.7.13.GitHub proof-of-concept repositories, 25 Oct 2026Exploit code

Description

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.

Text from CVE List

Affected versions 4

traefikaffected: < 2.11.57CVE List
traefikaffected: >= 3.0.0, < 3.7.13CVE List
github.com/traefik/traefik/v3, Gofrom 3.0.0, fixed in 3.7.13OSV
github.com/traefik/traefik/v2, Gofrom first release, fixed in 2.11.57OSV