CVE-2026-88877
Awaiting Analysis Awaiting Analysis - Queue

Traefik Ingress Redirect Bypass via Host Port Handling

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88877
EUVD
EUVD-2026-75427

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
traefik traefik From 3.7.0 (inc) to 3.7.12 (inc)
traefik traefik From 3.7.0 (inc) to 3.7.11 (inc)
traefik traefik 3.7.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88877 is an authentication bypass vulnerability in Traefik versions 3.7.0 through 3.7.11. It occurs when an Ingress resource in Kubernetes includes both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The Kubernetes ingress-nginx provider incorrectly creates a secondary router that matches requests based solely on the host, omitting authentication and other middleware protections. This allows attackers to bypass security measures by sending requests with a non-numeric or empty port in the Host header, which bypasses the redirect and forwards the request to the protected backend without applying intended middleware like BasicAuth or IP allowlisting.

The vulnerability is fixed in Traefik v3.7.12. Versions before v3.7.0 are not affected.

Detection Guidance

To detect this vulnerability, check Traefik versions between 3.7.0 and 3.7.11. Inspect Kubernetes Ingress resources for both authentication annotations and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. Test with malformed Host headers like 'Host: www.example.com:x' to see if requests bypass authentication.

Impact Analysis

This vulnerability allows attackers to bypass authentication and other security controls like IP allowlisting. By sending a malformed Host header (e.g., Host: www.example.com:x), they can access protected backend services without proper authorization. This could lead to unauthorized data access, privilege escalation, or other malicious activities depending on the backend service.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA by allowing unauthorized access to sensitive data. Authentication bypasses may violate requirements for access controls and data protection. Organizations using affected Traefik versions must patch to avoid potential compliance violations and data breaches.

Mitigation Strategies

Upgrade Traefik to version 3.7.12 or later immediately. If upgrading is not possible, remove the conflicting nginx.ingress.kubernetes.io/from-to-www-redirect annotation from affected Ingress resources or adjust the redirect regex to handle malformed ports.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88877. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart