CVE-Katalog

CVE-2026-88007

Traefik is an open source HTTP reverse proxy and load…

[CVE-Katalog]

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Schweregrad
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.60% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
GoRelease not reportedgithub.com/traefik/traefikNot reportedUnknownSource applicability is not establishedGO-2026-6466
GoRelease not reportedgithub.com/traefik/traefik/v22.11.57UnknownSource applicability is not established[GHSA-QQJF-53CJ-PWVV]GO-2026-6466
GoRelease not reportedgithub.com/traefik/traefik/v33.7.13UnknownSource applicability is not established[GHSA-QQJF-53CJ-PWVV]GO-2026-6466
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
GoRelease not reportedgithub.com/traefik/traefikNot reportedUnknownSource applicability is not establishedGO-2026-6466
GoRelease not reportedgithub.com/traefik/traefik/v22.11.57UnknownSource applicability is not established[GHSA-QQJF-53CJ-PWVV]GO-2026-6466
GoRelease not reportedgithub.com/traefik/traefik/v33.7.13UnknownSource applicability is not established[GHSA-QQJF-53CJ-PWVV]GO-2026-6466
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "github.com/traefik/traefik/v3",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.7.13"
            }
          ]
        }
      ],
      "ecosystem": "Go",
      "provider_url": "https://osv.dev/vulnerability/GHSA-qqjf-53cj-pwvv",
      "fixed_version": "3.7.13",
      "provider_source": "pypi",
      "provider_record_id": "GHSA-QQJF-53CJ-PWVV",
      "provider_updated_at": "2026-09-17T17:40:39.744145519Z",
      "applicability_unknown": true
    },
    {
      "name": "github.com/traefik/traefik/v2",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "2.11.0"
            },
            {
              "fixed": "2.11.57"
            }
          ]
        }
      ],
      "ecosystem": "Go",
      "provider_url": "https://osv.dev/vulnerability/GHSA-qqjf-53cj-pwvv",
      "fixed_version": "2.11.57",
      "provider_source": "pypi",
      "provider_record_id": "GHSA-QQJF-53CJ-PWVV",
      "provider_updated_at": "2026-09-17T17:40:39.744145519Z",
      "applicability_unknown": true
    },
    {
      "name": "traefik",
      "ranges": [
        {
          "fixed": "3.7.12",
          "introduced": "3.0.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88007",
      "fixed_version": "3.7.12",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-88007",
      "provider_updated_at": "2026-09-14T19:58:52.257"
    },
    {
      "name": "github.com/traefik/traefik",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "ecosystem": "Go",
      "fixed_version": "",
      "provider_record_id": "GO-2026-6466",
      "applicability_unknown": true
    },
    {
      "name": "github.com/traefik/traefik/v2",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "2.11.0"
            },
            {
              "fixed": "2.11.57"
            }
          ]
        }
      ],
      "ecosystem": "Go",
      "fixed_version": "2.11.57",
      "provider_record_id": "GO-2026-6466",
      "applicability_unknown": true
    },
    {
      "name": "github.com/traefik/traefik/v3",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.7.13"
            }
          ]
        }
      ],
      "ecosystem": "Go",
      "fixed_version": "3.7.13",
      "provider_record_id": "GO-2026-6466",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Die Paketzuordnung läuft.

Beobachtet:

Referenzen

[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]