# CVE-2026-88008: Traefik HTTP request smuggling via unrestricted protocol upgrade

Source: https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-88008 · Severity: critical · CVSS 9.1 · Published 2026-09-10

Traefik, a popular reverse proxy and load balancer, forwards client-initiated HTTP/2 protocol upgrade requests to backend services without validating whether the upgrade is authorized or supported. When a backend accepts an h2c (HTTP/2 Cleartext) upgrade and returns a 101 Switching Protocols response, Traefik enters a raw byte tunnel mode that bypasses its routing rules and security middleware (authentication, rate limiting, IP allowlisting). An attacker can exploit this by requesting an upgrade through an unprotected path, then sending HTTP/2 requests to protected administrative paths on the same backend, completely circumventing security controls.

Technologies: [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik), [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2), [github.com/traefik/traefik/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3), [Traefik](https://junglewise.ai/threats/technologies/traefik). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Traefik](https://junglewise.ai/threats/vendors/traefik).

## Quick answers

**Is CVE-2026-88008 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88008 being exploited in the wild.

**How severe is CVE-2026-88008?** Critical severity, with a CVSS score of 9.1, published 10 September 2026.

**Which products and versions are affected?** github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) >= 2.11.26, < 2.11.57, SEMVER:introduced=2.11.26,fixed=2.11.57; github.com/traefik/traefik/v3 (Go) >= 3.4.2, < 3.7.13, SEMVER:introduced=3.4.2,fixed=3.7.13; Traefik v2.11.26 to v2.11.56, v3.4.2 to v3.6.x.

**Is there a fix for CVE-2026-88008?** Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.57 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88008 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-88008?** Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/traefik/traefik/v2 (Go): upgrade to 2.11.57 or later

  ```sh
  go get github.com/traefik/traefik/v2@v2.11.57
  ```

- github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later

  ```sh
  go get github.com/traefik/traefik/v3@v3.7.13
  ```


## Technical details

This is an HTTP request smuggling vulnerability in Traefik's HTTP reverse proxy layer. The root cause is the unrestricted forwarding of client-supplied `Connection: Upgrade` and `Upgrade: <token>` headers to backend services. When a backend accepts an h2c upgrade (triggered by `Upgrade: h2c` and `HTTP2-Settings` headers) and responds with `101 Switching Protocols`, Traefik's reverse proxy (net/http/httputil.ReverseProxy) enters tunnel mode, copying raw bytes between client and backend without further HTTP parsing or middleware enforcement. The vulnerability occurs because: (1) Traefik forwards upgrade tokens without validating they are explicitly supported (only WebSocket should be allowed for HTTP protocol upgrades), (2) after receiving a 101 response, the routing/middleware chain is no longer applied to subsequent requests on that connection, and (3) an attacker can establish the tunnel through an unprotected router and send HTTP/2 requests to protected paths via the same backend connection. The attack requires a backend that honors h2c upgrades without strict validation of the HTTP/1.1 Connection header. Patches are available in v2.11.57 and v3.7.13, which strip the `Upgrade: h2c` and `HTTP2-Settings` headers before forwarding, while preserving legitimate WebSocket upgrades.

## Affected products

- Traefik Traefik v2.11.26 to v2.11.56, v3.4.2 to v3.6.x

## Identifiers

- CVE-2026-88008
- GHSA-w4v4-9rw7-5326
- GO-2026-6468

## Timeline

- 2026-09-07: disclosed: Vulnerability disclosed in GitHub Advisory GHSA-w4v4-9rw7-5326
- 2026-09-10: patched: Patches released: Traefik v2.11.57 and v3.7.13

## References

- [https://api.github.com/users/ihopenre-eng](https://api.github.com/users/ihopenre-eng)
- [https://github.com/ihopenre-eng](https://github.com/ihopenre-eng)
- [https://api.github.com/users/ihopenre-eng/gists%7B/gist_id%7D](https://api.github.com/users/ihopenre-eng/gists%7B/gist_id%7D)
- [https://api.github.com/users/ihopenre-eng/repos](https://api.github.com/users/ihopenre-eng/repos)
- [https://avatars.githubusercontent.com/u/247072151?v=4](https://avatars.githubusercontent.com/u/247072151?v=4)
- [https://api.github.com/users/ihopenre-eng/events%7B/privacy%7D](https://api.github.com/users/ihopenre-eng/events%7B/privacy%7D)

## Related threats

- [Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate](https://junglewise.ai/threats/cve-2026-121966-traefik-2-x-before-2-11-60-and-3-x-before-3-7-16-sends)
- [Traefik FastProxy data race in HTTP/1 upgrades](https://junglewise.ai/threats/cve-2026-119574-traefik-from-3-2-0-before-3-7-15-contains-a-data-race-in-the)
- [Traefik authentication bypass in TLS options resolution](https://junglewise.ai/threats/cve-2026-114656-traefik-before-2-11-58-and-3-7-13-contains-an-authentication)
- [Traefik NTLM/Kerberos TLS configuration bypass](https://junglewise.ai/threats/cve-2026-114642-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-stores-its)
- [Traefik authentication bypass in backend connection pool](https://junglewise.ai/threats/cve-2026-114639-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-contains)