Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Traefik HTTP/3 may expose another user’s data

CVE-2026-88007 · published 1 month ago
Summary

If you run Traefik version 2.11.0 through 2.11.57 or 3.7.0 through 3.7.12 with HTTP/3 enabled and a back‑end that uses NTLM or Negotiate authentication, a separate client could reuse the authenticated connection and read data that belongs to someone else. Upgrade Traefik to version 2.11.57 or later (or 3.7.13 or later) to fix the issue.

What to do
  • Update github.com traefik to version 3.7.13.
  • Update github.com traefik to version 2.11.57.
  • Update traefik github.com/traefik/traefik/v2 to version 2.11.57.
  • Update traefik github.com/traefik/traefik/v3 to version 3.7.13.
Affected software
Ecosystem VendorProductAffected versions
– traefik traefik >= 2.11.0, < 2.11.57
>= 2.8.2, < 2.11.56
>= 3.0.0, < 3.7.12
go github.com traefik >= 3.0.0, < 3.7.13
Fix: upgrade to 3.7.13
go github.com traefik >= 2.11.0, < 2.11.57
Fix: upgrade to 2.11.57
Go traefik github.com/traefik/traefik All versions
Go traefik github.com/traefik/traefik/v2 >= 2.11.0, < 2.11.57
Fix: upgrade to 2.11.57
Go traefik github.com/traefik/traefik/v3 >= 3.0.0, < 3.7.13
Fix: upgrade to 3.7.13
Original advisory text
Traefik HTTP/3 Backend NTLM Connection Reuse
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
CWE-863Incorrect Authorization
Timeline
Published10 Sep 2026
Updated11 Oct 2026
First seen10 Sep 2026
Sources
CVE-2026-88007 · NVD
CVE-2026-88007 · MITRE
GHSA-qqjf-53cj-pwvv · GHSA
CVE-2026-88007 · OSV
GO-2026-6466 · OSV
Track software like this
Free during beta