CVE-2026-88009
Received Received - Intake

HTTP Request Target Bypass in Traefik

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88009
EUVD
EUVD-2026-75578

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
traefik traefik to 2.11.57 (exc)
traefik traefik to 3.7.13 (exc)
traefik traefik 2.11.57
traefik traefik From 3.0.0 (inc) to 3.7.13 (exc)
traefik traefik 3.7.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1286 The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88009 is a security flaw in Traefik, a reverse proxy and load balancer. It involves HTTP/1 requests with rootless or opaque request targets (e.g., http:example.com/admin). Go's URL handling stores such targets in URL.Opaque, leaving URL.Path empty. Traefik processes routing and logging based on the empty path but forwards the opaque target to the backend, allowing bypasses of security checks.

Detection Guidance

To detect this vulnerability, monitor Traefik logs for requests with rootless opaque targets (e.g., GET http:example.com/admin). Check for 400 Bad Request responses from the denyOpaque handler. Inspect access logs for requests logged as GET / but forwarded with full paths.

Impact Analysis

This vulnerability allows attackers to bypass path-based security rules, such as authorization checks or access logs. It can enable cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion. Attackers could access restricted paths or hide malicious activity in logs.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data by bypassing path-based security controls, which may violate compliance requirements under GDPR (e.g., unauthorized data access) and HIPAA (e.g., unauthorized disclosure of protected health information). The bypass of path-scoped authorization and access logging evasion undermines data protection and audit mechanisms required by these regulations.

Mitigation Strategies

Upgrade Traefik to version 2.11.57 or 3.7.13 or later. If immediate upgrade is not possible, implement network-level controls to block rootless opaque requests at the firewall or reverse proxy level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart