CVE-2026-88004
Received Received - Intake

HTTP/2 Trailer Header Spoofing in Traefik

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted header name in an HTTP/1.1 chunked trailer or an HTTP/2 trailer. When the retry or buffering middleware reads the body before the reverse proxy clones the request, the attacker-controlled trailer value reaches a backend that merges trailers into the header namespace, bypassing the documented delete or reject behavior and potentially spoofing identity or forwarded routing data. This issue is fixed in 3.7.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88004
EUVD
EUVD-2026-75538

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
traefik traefik to 3.7.13 (exc)
traefik traefik From 3.2.0 (inc) to 3.7.13 (inc)
traefik traefik 3.7.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Traefik versions 3.2.0 to 3.7.12 have a flaw where request trailer values could bypass security checks. The entrypoint defenses only inspect req.Header and not req.Trailer, allowing unauthenticated clients to submit spoofed header names in HTTP/1.1 or HTTP/2 trailers. This bypasses sanitization for trusted headers like X-Forwarded-*, potentially spoofing identity or routing data. The fix in v3.7.13 prevents trailer values from reaching backend servers.

Detection Guidance

To detect this vulnerability, check if your Traefik version is between 3.2.0 and 3.7.12. Run: traefik version. If the version is within this range, the system is vulnerable. Additionally, inspect HTTP request trailers in traffic logs for unexpected header names like X_Auth_User or X-Forwarded-Prefix.

Impact Analysis

An attacker could exploit this to spoof headers like X-Forwarded-Prefix or X_Auth_User, bypassing authentication or routing controls. If combined with body-buffering middlewares, the trailer values may reach backend servers, allowing unauthorized access or data manipulation. Servers relying on header sanitization for security could be tricked into processing malicious input.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or access, violating confidentiality requirements in GDPR and HIPAA. Spoofed headers might allow attackers to bypass authentication, leading to unauthorized data processing or disclosure. Compliance with data protection standards could be compromised if backend systems process malicious trailer data.

Mitigation Strategies

Upgrade Traefik to version 3.7.13 or later immediately. Use the command: traefik --version to verify the current version. If upgrading is not possible, disable affected entrypoints or apply custom middleware to strip suspicious trailers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart