CVE-2026-88009: Traefik rootless HTTP/1 request-target routing bypass

CVE-2026-88009 · Severity: high · CVSS 8.2 · Published 2026-09-10

Traefik, a popular reverse proxy and load balancer, fails to properly normalize certain HTTP/1.1 request formats when routing traffic to backend services. An attacker can craft requests that Traefik internally routes as "/" but forwards to the backend with the attacker's original target intact, bypassing path-based routing guards and authorization policies. This allows unauthenticated attackers to access protected resources, cross vhosts, and bypass security middleware—all without modifying configuration.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go). Vendors: Go.

Quick answers

Is CVE-2026-88009 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88009 being exploited in the wild.
How severe is CVE-2026-88009?
High severity, with a CVSS score of 8.2, published 10 September 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) < 2.11.57, SEMVER:introduced=0,fixed=2.11.57; github.com/traefik/traefik/v3 (Go) >= 3.0.0, < 3.7.13, SEMVER:introduced=3.0.0,fixed=3.7.13.
Is there a fix for CVE-2026-88009?
Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.57 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88009 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-88009?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go) or github.com/traefik/traefik/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v2 (Go): upgrade to 2.11.57 or later
    go get github.com/traefik/traefik/v2@v2.11.57
  • github.com/traefik/traefik/v3 (Go): upgrade to 3.7.13 or later
    go get github.com/traefik/traefik/v3@v3.7.13

Technical details

The vulnerability is a request deserialization desynchronization (request smuggling variant). Go's url.ParseRequestURI() parses a rootless request-target (e.g., http:admin/secret) into URL.Opaque="admin/secret" with empty URL.Path. Traefik's entry-point pipeline (denyFragment, normalizePath, sanitizePath) inspects URL.Path and URL.RawPath, which are both empty, so these guards pass. The router matches on URL.Path="/" allowing any Host-only or PathPrefix("/") route. However, in pkg/proxy/httputil/proxy.go and pkg/proxy/fast/proxy.go, when rebuilding the outbound URL, the code sets Scheme, Host, Path, RawPath, and RawQuery but never clears URL.Opaque. When Go's http.Request.write() serializes the request, it prefers URL.Opaque over the escaped path, sending the attacker's byte-for-byte target to the backend. Middleware like forwardAuth and access logging also fail to inspect the real target. Against backends that resolve rootless paths (fasthttp, Python http.server), this yields cross-vhost routing, authorization bypass, and log evasion. Patches are available in v2.11.57 and v3.7.13; v3.0–v3.6 are end-of-life.

Affected products

  • Traefik Traefik v2.11.0 through v2.11.56, v3.0.0 through v3.7.12

Identifiers

  • CVE-2026-88009
  • GHSA-f52w-8j3h-j724
  • GO-2026-6465

Timeline

  • 2026-09-07: disclosed
  • 2026-09-07: patched: v2.11.57 and v3.7.13 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.