CVE-2026-88007 traefik CVE debrief

Who should care

Traefik users, especially those with HTTP/3 enabled and connection-bound NTLM or Negotiate authentication, and backend keep-alive enabled, should assess exposure and prioritize verification.

Why it matters

CVE-2026-88007 allows potential unauthorized data access and impersonation of authenticated victims in Traefik configurations with HTTP/3 enabled and connection-bound NTLM or Negotiate authentication, and backend keep-alive enabled. Traefik users should assess exposure and prioritize verification and updates.

• Potential unauthorized data access
• Possible impersonation of authenticated victims
• Required verification of HTTP/3 configurations
• Necessity to update to fixed versions

Technical summary

The HTTP/3 entrypoint ConnContext in Traefik does not call service.AddTransportOnContext, leading to a shared backend transport being used instead of a transport dedicated to each frontend connection. This can allow an unrelated client to reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. The issue is fixed in 2.11.57 and 3.7.13. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim.

Defensive priority

Traefik users should assess exposure and prioritize verification of HTTP/3 configurations, especially with connection-bound NTLM or Negotiate authentication and backend keep-alive enabled.

Recommended defensive actions

• Verify Traefik configurations for HTTP/3 and connection-bound NTLM or Negotiate authentication
• Assess exposure and prioritize verification of backend keep-alive settings
• Update to fixed versions 2.11.57 or 3.7.13
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in Traefik, an open-source HTTP reverse proxy and load balancer. The issue is related to the HTTP/3 entrypoint ConnContext not calling service.AddTransportOnContext, leading to a shared backend transport being used instead of a transport dedicated to each frontend connection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.