CVE-2026-88007
github.com/traefik/traefik: Traefik HTTP/3 Backend NTLM Connection Reuse
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Red Hat.
Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 | 2.11.57 et 1 autres |
| minimos | traefik-3, traefik-fips-3 | 3.7.13-r0 |
| rapidfort alpine 3.20 | traefik | 3.7.12-r0 |
| rapidfort alpine 3.21 | traefik | 3.7.12-r0 |
| rapidfort alpine 3.22 | traefik | 3.7.12-r0 |
| rapidfort alpine 3.23 | traefik | 3.7.12-r0 |
| rapidfort alpine 3.24 | traefik | 3.7.12-r0 |
Afficher les 9 entrées de 7 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v2 | 2.11.57 |
| go::GitHub Security Advisory Go | github.com/traefik/traefik/v3 | 3.7.13 |
| minimos | traefik-3 | 3.7.13-r0 |
| minimos | traefik-fips-3 | 3.7.13-r0 |
| rapidfort alpine 3.20 | traefik | 3.7.12-r0 |
| rapidfort alpine 3.21 | traefik | 3.7.12-r0 |
| rapidfort alpine 3.22 | traefik | 3.7.12-r0 |
| rapidfort alpine 3.23 | traefik | 3.7.12-r0 |
| rapidfort alpine 3.24 | traefik | 3.7.12-r0 |
Références
- https://access.redhat.com/security/cve/CVE-2026-88007
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/commit/ff39c47d7459dec9cd8de63c1a4e7aa7315bdc1c
- https://github.com/traefik/traefik/pull/13812
- https://github.com/traefik/traefik/releases/tag/v2.11.57
- https://github.com/traefik/traefik/releases/tag/v3.7.13
- https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv
- https://nvd.nist.gov/vuln/detail/CVE-2026-88007