CVE-2026-88877Patch(traefik / traefik)

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch traefik traefik systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.

traefik CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/traefik/traefik/security/advisories/GHSA-cjr6-pf59-jq29

Vendor / third-party advisories

https://www.vulncheck.com/advisories/traefik-3.7.0-authentication-bypass-via-from-to-www-redirect

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

traefik

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked at 2 mentions on most recent observed day (2026-09-11)
3 total mentions across 2 days

Affected systems

Vendors

traefik

Products

traefik

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

Patch

133.3%

Disclosure

133.3%

General

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-10	1	Patch1
2026-09-11	2	Disclosure1General1

Full discourse3 posts

Rıdvan Yağlı@ridvanyagli46d
Disclosure
🔴 Traefik'te CVSS 9.8 Critical Authentication Bypass! CVE-2026-88877, Traefik 3.7.0–3.7.11 sürümlerinde Kubernetes ingress-nginx provider'ını etkiliyor. from-to-www-redirect ile authentication annotation'larının belirli kombinasyonunda saldırgan, özel hazırlanmış Host header'ı kullanarak BasicAuth ve source-IP allowlist gibi annotation-derived middleware'leri bypass edip korunan backend'e erişebiliyor. CVSS 3.1: 9.8 Critical Yamalanan sürüm: Traefik 3.7.12 Kubernetes üzerinde Traefik kullanan sistemlerin kontrol edilmesi ve güncellenmesi öneriliyor. https://github.com/traefik/traefik/security/advisories/GHSA-cjr6-pf59-jq29
Post summary
This advisory discloses a critical authentication bypass (CVE‑2026‑88877) in Traefik 3.7.x, caused by specific annotation combinations and a crafted Host header, with CVSS 9.8 and a patch released in version 3.7.12.
01016141.7K
2.4K followersView on X
NewNormal Security@NewScanTeam45d
General
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 11 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Reverse proxy on a build named in this week's advisories — reach the protected backend with none of its auth, allowlist or rate-limit middleware (Traefik CVE-2026-88877, CVE-2026-88007, CVE-2026-88009, CVE-2026-88008, CVE-2026-88004, CVE-2026-88878, CVE-2026-88879, CVE-2026-88011, CVE-2026-88012) 🔓 Authorization written as a list of HTTP verbs, with one verb missing from the list — send the same request as PATCH and the access check never runs (OpenNMS CVE-2026-89054) 🕳️ Media-server plugin status page answering anonymously — read the host's binary paths, open ports and plugin log without logging in (WWBN AVideo CVE-2026-89248) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM
Post summary
The post provides a daily snapshot of new CVEs, enumerating several technical vulnerabilities, and promotes using the NewScan tool for detection, without mentioning PoC or active exploitation.
0000051
7 followersView on X
Upwind Security MDR@UpwindMDR46d
Patch
🚨Critical - Traefik ingress-nginx Router Split Auth Bypass (CVE-2026-88877) Traefik’s Kubernetes ingress-nginx provider mishandles Ingresses combining an auth annotation with http://nginx.ingress.kubernetes.io/from-to-www-redirect, creating a sibling router. A crafted Host header with an empty/non-numeric port bypasses RedirectRegex and skips auth + other annotation-derived middlewares (incl. source-IP allowlists), proxying directly to the protected backend. 👉Affected: traefik v3.7.0-3.7.11 | Upgrade to v3.7.12 to mitigate.
Post summary
Critical CVE-2026-88877 enables authentication bypass in Traefik via crafted Host headers; upgrading to v3.7.12 mitigates the issue.
0000076
303 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	traefik	traefik	-	-	-

Explore more

Back to dashboard traefik CVEs traefik vulnerabilities