← Vulnerability feed

Vulnerability record · CVE-2026-88011 · published 10 September 2026

CVE-2026-88011: Traefik authentication bypass by spoofing vulnerability

Traefik · Traefik

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.

5.3 CVSS 4.0 Medium EPSS 0.42% · top 65.9% CWE-290 · Authentication bypass by spoofing
5.3CVSS 4.0 base score
0.42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
15 Sep 2026Last modified by NVD

Description

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User while normalization-prone CGI, WSGI, PHP, and NGINX backends collapse both names. A backend can consequently consume the client value instead of the identity Traefik asserted, allowing identity spoofing for any header managed by Traefik. The aliasHeadersStrategy protection is disabled by default and must be configured as delete or reject. The mitigation is available in 2.11.56 and 3.7.12.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8 Patch
https://github.com/traefik/traefik/pull/13720 Issue TrackingPatch
https://github.com/traefik/traefik/releases/tag/v2.11.56 Release Notes
https://github.com/traefik/traefik/releases/tag/v3.7.12 Release Notes
https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c PatchVendor Advisory

Track CVE-2026-88011 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.3CVE-2026-88877Traefik insecure direct object reference vulnerabilityTraefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses t…EPSS 0.65%9.3CVE-2026-85595Traefik improper authentication vulnerabilityTraefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware wher…EPSS 0.69%9.1CVE-2026-88007Traefik improper authentication vulnerabilityTraefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call…EPSS 0.60%8.8CVE-2026-88009Traefik http request smuggling vulnerabilityTraefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that G…EPSS 0.44%8.8CVE-2025-32431Traefik path traversal vulnerabilityTraefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vul…EPSS 0.93%8.7CVE-2023-54365Traefik uncontrolled resource consumption vulnerabilityTraefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard libr…EPSS 0.77%8.2CVE-2026-85597Traefik incorrect authorization vulnerabilityTraefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to by…EPSS 0.35%

Source: NIST National Vulnerability Database (record CVE-2026-88011), CISA KEV, FIRST EPSS (scores of 2026-10-05). This page is refreshed as NVD updates the record.