CVE-2026-88007: Traefik HTTP/3 backend NTLM connection reuse

CVE-2026-88007 · Severity: critical · CVSS 9.1 · Published 2026-09-10

Traefik is a reverse proxy and load balancer commonly used in containerized environments. When HTTP/3 is enabled, the proxy fails to properly isolate authentication sessions for backends using NTLM or Kerberos authentication tied to persistent TCP connections. An attacker can reuse a victim's authenticated backend connection without credentials, allowing unauthorized access to sensitive data and the ability to perform actions as the victim.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go). Vendors: Go.

Quick answers

Is CVE-2026-88007 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88007 being exploited in the wild.
How severe is CVE-2026-88007?
Critical severity, with a CVSS score of 9.1, published 10 September 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) >= 2.11.0, < 2.11.57, SEMVER:introduced=2.11.0,fixed=2.11.57; github.com/traefik/traefik/v3 (Go) >= 3.0.0, < 3.7.13, SEMVER:introduced=3.0.0,fixed=3.7.13.
Is there a fix for CVE-2026-88007?
Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.57 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88007 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-88007?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go) or github.com/traefik/traefik/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v2 (Go): upgrade to 2.11.57 or later
    go get github.com/traefik/traefik/v2@v2.11.57
  • github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later
    go get github.com/traefik/traefik/v3@v3.7.13

Technical details

The vulnerability is a protocol-parity bug in HTTP/3 connection context initialization. HTTP/1.1 and HTTP/2 properly call service.AddTransportOnContext() to create a per-connection transport holder for NTLM/Negotiate isolation, but the HTTP/3 handler in server_entrypoint_tcp_http3.go omits this call. When kerberosRoundTripper checks for the transportKey context value and finds it missing, it falls back to the shared OriginalRoundTripper. An attacker can then send an unauthenticated HTTP/3 request that reuses the same backend TCP connection a victim previously authenticated to via NTLM or Negotiate, inheriting the victim's credentials without sending authorization headers. The attack requires HTTP/3 to be enabled on the entrypoint, a routed backend using connection-bound NTLM/Negotiate auth, and backend connection reuse. Patches available in v2.11.57 and v3.7.13.

Affected products

  • Traefik Traefik 2.11.0 to 2.11.56, 3.0.0 to 3.7.12

Identifiers

  • CVE-2026-88007
  • GHSA-qqjf-53cj-pwvv
  • GO-2026-6466

Timeline

  • 2026-09-07: disclosed: Published on GitHub Advisory Database
  • 2026-09-10: advisory: Advisory updated with additional details
  • 2026-09-01: patched: Patches released in v2.11.57 and v3.7.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.