CVE-2026-88009: Traefik rootless HTTP/1 request-target routing bypass

CVE-2026-88009 · Severity: high · CVSS 7.5 · Published 2026-09-10

Executive brief

Traefik, a popular reverse proxy and load balancer, fails to properly normalize certain HTTP/1.1 request formats when routing traffic to backend services. An attacker can craft requests that Traefik internally routes as "/" but forwards to the backend with the attacker's original target intact, bypassing path-based routing guards and authorization policies. This allows unauthenticated attackers to access protected resources, cross vhosts, and bypass security middleware—all without modifying configuration.

Technical details

The vulnerability is a request deserialization desynchronization (request smuggling variant). Go's url.ParseRequestURI() parses a rootless request-target (e.g., http:admin/secret) into URL.Opaque="admin/secret" with empty URL.Path. Traefik's entry-point pipeline (denyFragment, normalizePath, sanitizePath) inspects URL.Path and URL.RawPath, which are both empty, so these guards pass. The router matches on URL.Path="/" allowing any Host-only or PathPrefix("/") route. However, in pkg/proxy/httputil/proxy.go and pkg/proxy/fast/proxy.go, when rebuilding the outbound URL, the code sets Scheme, Host, Path, RawPath, and RawQuery but never clears URL.Opaque. When Go's http.Request.write() serializes the request, it prefers URL.Opaque over the escaped path, sending the attacker's byte-for-byte target to the backend. Middleware like forwardAuth and access logging also fail to inspect the real target. Against backends that resolve rootless paths (fasthttp, Python http.server), this yields cross-vhost routing, authorization bypass, and log evasion. Patches are available in v2.11.57 and v3.7.13; v3.0–v3.6 are end-of-life.

CVE-2026-88009: Traefik rootless HTTP/1 request-target routing bypass

Executive brief

Technical details

Affected products

Timeline

References

Related threats