Executive brief
Traefik, a popular reverse proxy and load balancer, forwards client-initiated HTTP/2 protocol upgrade requests to backend services without validating whether the upgrade is authorized or supported. When a backend accepts an h2c (HTTP/2 Cleartext) upgrade and returns a 101 Switching Protocols response, Traefik enters a raw byte tunnel mode that bypasses its routing rules and security middleware (authentication, rate limiting, IP allowlisting). An attacker can exploit this by requesting an upgrade through an unprotected path, then sending HTTP/2 requests to protected administrative paths on the same backend, completely circumventing security controls.
Technical details
This is an HTTP request smuggling vulnerability in Traefik's HTTP reverse proxy layer. The root cause is the unrestricted forwarding of client-supplied `Connection: Upgrade` and `Upgrade: <token>` headers to backend services. When a backend accepts an h2c upgrade (triggered by `Upgrade: h2c` and `HTTP2-Settings` headers) and responds with `101 Switching Protocols`, Traefik's reverse proxy (net/http/httputil.ReverseProxy) enters tunnel mode, copying raw bytes between client and backend without further HTTP parsing or middleware enforcement. The vulnerability occurs because: (1) Traefik forwards upgrade tokens without validating they are explicitly supported (only WebSocket should be allowed for HTTP protocol upgrades), (2) after receiving a 101 response, the routing/middleware chain is no longer applied to subsequent requests on that connection, and (3) an attacker can establish the tunnel through an unprotected router and send HTTP/2 requests to protected paths via the same backend connection. The attack requires a backend that honors h2c upgrades without strict validation of the HTTP/1.1 Connection header. Patches are available in v2.11.57 and v3.7.13, which strip the `Upgrade: h2c` and `HTTP2-Settings` headers before forwarding, while preserving legitimate WebSocket upgrades.
Affected products
- Traefik Traefik v2.11.26 to v2.11.56, v3.4.2 to v3.6.x
Timeline
- 2026-09-07: disclosed: Vulnerability disclosed in GitHub Advisory GHSA-w4v4-9rw7-5326
- 2026-09-10: patched: Patches released: Traefik v2.11.57 and v3.7.13