CVE-2026-88009

Traefik is an open source HTTP reverse proxy and load balancer.

Traefik

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and…

10. Sep 2026

Ausgewertete Quellen

• NVD
  CVE-2026-88009
• GitHub
  https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724