CVE-2026-88008
github.com/traefik/traefik: Traefik: Incorrect authorization due to HTTP/2 protocol confusion
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Red Hat. Más baja según GHSA (alta).
Descripción
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine edge | traefik | 3.7.13-r0 |
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 | 2.11.57 y 1 más |
| minimos | traefik-3, traefik-fips-3 | 3.7.13-r0 |
| rapidfort alpine 3.20 | traefik | 3.7.13-r0 |
| rapidfort alpine 3.21 | traefik | 3.7.13-r0 |
| rapidfort alpine 3.22 | traefik | 3.7.13-r0 |
| rapidfort alpine 3.23 | traefik | 3.7.13-r0 |
| rapidfort alpine 3.24 | traefik | 3.7.13-r0 |
Mostrar las 10 entradas de 8 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine edge | traefik | 3.7.13-r0 |
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v2 | 2.11.57 |
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v3 | 3.7.13 |
| minimos | traefik-3 | 3.7.13-r0 |
| minimos | traefik-fips-3 | 3.7.13-r0 |
| rapidfort alpine 3.20 | traefik | 3.7.13-r0 |
| rapidfort alpine 3.21 | traefik | 3.7.13-r0 |
| rapidfort alpine 3.22 | traefik | 3.7.13-r0 |
| rapidfort alpine 3.23 | traefik | 3.7.13-r0 |
| rapidfort alpine 3.24 | traefik | 3.7.13-r0 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-88008
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/commit/a277e94664ffc1ce9543df552d3bbf48d4d3b8b3
- https://github.com/traefik/traefik/pull/13797
- https://github.com/traefik/traefik/releases/tag/v2.11.57
- https://github.com/traefik/traefik/releases/tag/v3.7.13
- https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326
- https://nvd.nist.gov/vuln/detail/CVE-2026-88008