{"id":"CVE-2026-88009","title":"Traefik is an open source HTTP reverse proxy and load balancer","summary":"Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path eval…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-444","CWE-1286"],"vendor":"traefik","product":"traefik","affected":["traefik < 2.11.57","traefik >= 3.0.0, < 3.7.13"],"patched":["traefik 3.7.13"],"published":"2026-09-10","updated":"2026-09-14","sourceUpdated":"2026-09-14T19:59:14.810","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88009","references":[{"url":"https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9","label":"security-advisories@github.com"},{"url":"https://github.com/traefik/traefik/pull/13796","label":"security-advisories@github.com"},{"url":"https://github.com/traefik/traefik/releases/tag/v2.11.57","label":"security-advisories@github.com"},{"url":"https://github.com/traefik/traefik/releases/tag/v3.7.13","label":"security-advisories@github.com"},{"url":"https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88009"},{"url":"https://github.com/traefik/traefik"}],"tags":["nvd","cve.org","osv","go"],"epss":0.0027,"epssPercentile":0.19354,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-10T15:39:54.256441Z"},"scores":{"nvd":8.2,"cna":8.8},"ingestedAt":"2026-09-13T05:29:34.871Z","aliases":["GHSA-f52w-8j3h-j724","GO-2026-6465"],"ecosystem":"go","slug":"CVE-2026-88009","body":"## Overview\n\nTraefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against a path normalized to / but forwards URL.Opaque verbatim to the backend, allowing cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion when the backend interprets the opaque target as a path. This issue is fixed in 2.11.57 and 3.7.13.\n\n## Affected\n\n- `traefik < 2.11.57`\n- `traefik >= 3.0.0, < 3.7.13`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `traefik 3.7.13`\n\n## Package advisory (CVE-2026-88009)\n\nAffected packages:\n\n- `github.com/traefik/traefik/v3 >= 3.0.0, < 3.7.13`\n- `github.com/traefik/traefik/v2 < 2.11.57`\n\nPatched in:\n\n- `github.com/traefik/traefik/v3 3.7.13`\n- `github.com/traefik/traefik/v2 2.11.57`\n\nSource: https://osv.dev/vulnerability/GHSA-f52w-8j3h-j724","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":203225,"id":"CVE-2026-88009","ts":1789416896126,"field":"cvss","old":"8.8","new":"8.2"}]}