Exploitation ongoing with high activity in latest observed window (4 mentions)
Immediate actions
Patch traefik traefik systems immediately
Assume compromise if assets are exposed
Recommended action window: Immediate (within 24h)
NVD description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.
Warning: A critical authentication bypass vulnerability in #Traefik lets an HTTP/3 client hijack another user's authenticated backend connection. CVE-2026-88007 CVSS(4.0): 9.1. Read the advisory https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv and #Patch#Patch#Patch
Post summary
Traefik’s critical authentication bypass vulnerability CVE‑2026‑88007 allows an HTTP/3 client to hijack another user’s authenticated backend session, scoring 9.1 on CVSS. A patch is referenced in the included GitHub advisory link.
Recent probes target a critical GitLab file-read flaw (CVE-2026-85706, CVSS 10.0) affecting data privacy. Also, a critical HTTP/3 backend redirect vulnerability (CVE-2026-88007) threatens data integrity via header exfiltration. Patch urgently. #Cybersecurity#ZeroDay#InfoSec
Post summary
The statement reports that CVE‑2026‑85706 and CVE‑2026‑88007 are currently being actively probed, posing privacy and integrity risks, and urges immediate patching.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day.
𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 11 Sep 2026
𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
📦 Reverse proxy on a build named in this week's advisories — reach the protected backend with none of its auth, allowlist or rate-limit middleware (Traefik CVE-2026-88877, CVE-2026-88007, CVE-2026-88009, CVE-2026-88008, CVE-2026-88004, CVE-2026-88878, CVE-2026-88879, CVE-2026-88011, CVE-2026-88012)
🔓 Authorization written as a list of HTTP verbs, with one verb missing from the list — send the same request as PATCH and the access check never runs (OpenNMS CVE-2026-89054)
🕳️ Media-server plugin status page answering anonymously — read the host's binary paths, open ports and plugin log without logging in (WWBN AVideo CVE-2026-89248)
Test your stack with NewScan — free, self-hosted:
https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve
#infosec#AppSec#AuthBypass#CSO#REDTEAM
Post summary
A daily CVE roundup enumerates several new vulnerabilities affecting reverse proxies, authorization logic, and media‑server plugins, but it offers no evidence of PoC, active exploitation, or remediation.
The tweet announces a critical CVE (CVE‑2026‑88007) affecting Traefik’s HTTP/3 backend with NTLM connection reuse leading to authentication bypass, and directs readers to a dailycve article for more details.
