Is CVE-2026-88004 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88004 being exploited in the wild.

How severe is CVE-2026-88004?

High severity, with a CVSS score of 7.4, published 10 September 2026.

Which products and versions are affected?

github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) >= 3.2.0, < 3.7.13, SEMVER:introduced=3.2.0,fixed=3.7.13.

Is there a fix for CVE-2026-88004?

Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88004 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-88004?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88004: Traefik entrypoint header sanitization bypass via request trailers

Q: Is there a fix for CVE-2026-88004?

Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-88004 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-88004?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88004 · Severity: high · CVSS 7.4 · Published 2026-09-10

Traefik is a reverse proxy that provides built-in protections to prevent clients from spoofing trusted security headers used for authentication and access control. A flaw in Traefik v3 allows attackers to bypass these protections by smuggling forged headers through a secondary HTTP channel (request trailers). When certain middleware components buffer request bodies, attackers can inject forged identity headers with attacker-chosen values that reach backend services, potentially enabling account takeover, privilege escalation, or IP-based access bypass in downstream systems that rely on these headers.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik. Vendors: Go, Traefik.

Quick answers

Is CVE-2026-88004 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88004 being exploited in the wild.
How severe is CVE-2026-88004?: High severity, with a CVSS score of 7.4, published 10 September 2026.
Which products and versions are affected?: github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) >= 3.2.0, < 3.7.13, SEMVER:introduced=3.2.0,fixed=3.7.13.
Is there a fix for CVE-2026-88004?: Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88004 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-88004?: Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later
```
go get github.com/traefik/traefik/v3@v3.7.13
```

Technical details

The vulnerability is a header-name sanitization bypass in Traefik v3's custom reverse proxy (`pkg/proxy/httputil`). All entrypoint sanitization handlers—`removeAliasingHeaders`, `rejectAliasingHeaders`, `removeHeadersWithUnderscores`, `rejectHeadersWithUnderscores`, and `DeleteXForwardedHeaders`—iterate only `req.Header` and ignore `req.Trailer`, despite doc comments claiming coverage of both. Unauthenticated clients can declare HTTP trailers containing aliasing names (e.g., `X_Auth_User`) or trusted names (e.g., `X-Forwarded-Prefix`). Go's HTTP server pre-fills trailer names in `req.Trailer` before the handler runs, making them invisible to entrypoint checks. On bare proxy paths, trailer values are dropped (limiting impact to name-level); however, when body-buffering middleware (retry with `status` codes or the `buffering` middleware) reads the body first, trailer values are populated before the proxy clone, allowing attacker-controlled values to reach the backend. Backends that merge trailers into header namespaces (e.g., pre-fix libevent per CVE-2026-63379) then trust and act on the smuggled headers for authorization decisions. Traefik v2 is unaffected because it uses Go's standard-library `httputil.ReverseProxy`, which does not forward request trailer values. The fix stops forwarding request trailer values to backends while preserving trailer names as permitted by RFC 9110 §6.6.2.

Affected products

Traefik Traefik v3.2.0 through v3.7.12

Identifiers

CVE-2026-88004
GHSA-v67p-phpq-fc8x
GO-2026-6467

Timeline

2026-09-07: disclosed
2026-09-10: advisory
2026-09-10: patched: Traefik v3.7.13 released with fix; v3.2–v3.6 end-of-life, users must upgrade to v3.7.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.