CVE-2026-71324

[CVE catalog]

Severity

High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Published

Aug 6, 2026, 3:56:33 PM UTC

Source

[NVD] · [CVE record]

EPSS

1.06% · Oct 25, 2026

A flaw was found in Traefik. Traefik's HTTP reverse proxy can improperly handle HTTP/2 or HTTP/3 CONNECT requests forwarded to an HTTP/1.1 upstream. If the upstream sends a keep-alive non-2xx response and does not fully drain the body, the desynchronized backend socket is returned to a shared pool. An unauthenticated attacker can exploit this by making a different client read their smuggled response, which can lead to information disclosure, potentially exposing authenticated or private content from other requests. The ForwardAuth middleware can also be affected, further exposing the authentication client pool to desynchronization. github.com/traefik/traefik: Traefik: Information disclosure via response poisoning in shared backend pool A desynchronization flaw in Traefik's HTTP reverse proxy allows an unauthenticated remote attacker to perform HTTP request smuggling. When forwarding HTTP/2 or HTTP/3 CONNECT requests to an HTTP/1.1 upstream that responds with a keep-alive non-2xx status without draining the request body, Traefik re-adds the tainted connection to its shared transport pool. Subsequent requests from other clients reused on this socket read the attacker's smuggled response, leading to cross-tenant data leakage or exposed authentication credentials, bypassing non-root container boundaries. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.