CVE-2026-88009

HighCVSS 8.2/10Last modified Sep 14, 2026

Description

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-444 CWE-1286

Affected software

Vendor	Product	Versions
traefik	traefik	< 2.11.57; >= 3.0.0, < 3.7.13

References

https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9Patch
https://github.com/traefik/traefik/pull/13796Issue Tracking, Patch
https://github.com/traefik/traefik/releases/tag/v2.11.57Release Notes
https://github.com/traefik/traefik/releases/tag/v3.7.13Release Notes
https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724Patch, Vendor Advisory

Timeline

Published: Sep 10, 2026
Last modified: Sep 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-88019.8Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, fro CVE-2026-880105.3Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.g CVE-2026-880118.1Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form he CVE-2026-880125.3Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPo CVE-2026-880135.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the CVE-2026-880146.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the CVE-2026-880155.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local CVE-2026-880167.1rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/CVE-2026-880177.3rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the CVE-2026-880189.8rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve CVE-2026-88024.3A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file CVE-2026-880206.1Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interfa