CVE-2026-88007
Received Received - Intake

HTTP/3 Kerberos Authentication Connection Reuse in Traefik

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88007
EUVD
EUVD-2026-75544

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
traefik traefik From 2.11.0 (inc) to 2.11.57 (exc)
traefik traefik 2.11.57
traefik traefik From 3.0.0 (inc) to 3.7.12 (inc)
traefik traefik to 3.7.12 (inc)
traefik traefik to 2.11.56 (inc)
traefik traefik to 2.11.57 (inc)
traefik traefik 3.7.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88007 is a critical vulnerability in Traefik, an open source HTTP reverse proxy and load balancer. It affects versions 2.11.0 to 2.11.57 and 3.7.13. The issue involves HTTP/3 backend connection reuse with NTLM or Negotiate (Kerberos) authentication. An unrelated HTTP/3 client can inherit an authenticated backend connection from a victim, bypassing authentication and accessing victim-only data or performing unauthorized actions.

Detection Guidance

Check Traefik version with 'traefik version' command. If running v2.11.0 to v2.11.56 or v3.0.0 to v3.7.12 with HTTP/3 enabled and NTLM/Negotiate authentication on backends, the system is vulnerable. Inspect Traefik logs for HTTP/3 connections to authenticated backends.

Impact Analysis

If you use Traefik with HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an attacker could exploit this to impersonate authenticated users without credentials. This could lead to unauthorized access to sensitive data or actions on your systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal consequences due to unauthorized access to protected health or personal information.

Mitigation Strategies

Upgrade Traefik to v2.11.57 or v3.7.13 or later. Disable HTTP/3 if not required. If HTTP/3 is necessary, ensure backend authentication does not use NTLM or Negotiate. Monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart