VulnSocial

CVE-2026-88009General(traefik / traefik)

LOWCVSS 8.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch traefik traefik systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.

traefik CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-444CWE-1286

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • traefik

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
traefik
Products
traefik

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-11: 2Patch / Workaround · 2026-09-11: 1Technical Details · 2026-09-11: 209-11
Signal classification2 categories
General
150.0%
Patch
150.0%
Referenced assets1 URL
Full discourse2 posts
  • NewNormal Security@NewScanTeam
    General

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 11 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Reverse proxy on a build named in this week's advisories — reach the protected backend with none of its auth, allowlist or rate-limit middleware (Traefik CVE-2026-88877, CVE-2026-88007, CVE-2026-88009, CVE-2026-88008, CVE-2026-88004, CVE-2026-88878, CVE-2026-88879, CVE-2026-88011, CVE-2026-88012) 🔓 Authorization written as a list of HTTP verbs, with one verb missing from the list — send the same request as PATCH and the access check never runs (OpenNMS CVE-2026-89054) 🕳️ Media-server plugin status page answering anonymously — read the host's binary paths, open ports and plugin log without logging in (WWBN AVideo CVE-2026-89248) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM

    Post summary

    The tweet lists several newly disclosed CVEs (Traefik, OpenNMS, WWBN AVideo) involving authentication bypass and information disclosure flaws detected by NewScan, but it provides no PoC, exploit code, patch information, or evidence of in‑the‑wild attacks.

    0000051
    7 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨HIGH - Traefik HTTP/1.x Opaque Request-Target Routing/Auth Bypass (CVE-2026-88009) Traefik mishandles rootless/opaque HTTP/1.x request-targets where Go sets URL.Opaque and leaves URL.Path empty, so routing/middleware (e.g., forwardAuth) and access logs treat the path as "/" while Traefik forwards the opaque target verbatim to the backend. This enables cross-vhost routing bypass, path-scoped auth bypass, and log evasion when the backend interprets the opaque target as a path. 👉Affected: Traefik < 2.11.57 and < 3.7.13 | Upgrade to 2.11.57 / 3.7.13

    Post summary

    CVE-2026-88009 allows Traefik to bypass routing, authentication, and logging via opaque HTTP/1.x request‑targets. The vulnerability is mitigated by upgrading to Traefik 2.11.57 or 3.7.13.

    0000083
    304 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apptraefiktraefik---

Explore more

Back to dashboardtraefik CVEstraefik vulnerabilities