Log in Start free

Vulnerability · Published Sep 10, 2026 · Assigned by GitHub_M

CVE-2026-88007Traefik HTTP/3 Backend NTLM Connection Reuse

Critical 9.1

In plain English

A critical-severity improper authentication in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.1Critical
Exploit odds (30 days)0.6%top 51.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/traefik/traefikno fix listedGO-2026-6466
Gogithub.com/traefik/traefik/v22.11.57GHSA-qqjf-53cj-pwvv
Gogithub.com/traefik/traefik/v22.11.57GO-2026-6466
Gogithub.com/traefik/traefik/v33.7.13GHSA-qqjf-53cj-pwvv
Gogithub.com/traefik/traefik/v33.7.13GO-2026-6466

Affected products (as reported)

VendorProductVersions
traefik traefik >= 2.11.0, < 2.11.57>= 3.0.0, < 3.7.13

Weakness: CWE-287, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References