CVE-2026-88008: 
NixOS vulnerability analysis and mitigation

CVE-2026-88008 is a high-severity authentication bypass vulnerability in Traefik, an open-source HTTP reverse proxy and load balancer, caused by improper handling of the HTTP/1.1 Upgrade: h2c mechanism. When Traefik forwards a client-supplied Connection: Upgrade, Upgrade: h2c, and HTTP2-Settings header to a shared backend that accepts the upgrade and returns 101 Switching Protocols, Traefik enters a raw byte tunnel and ceases to apply its router and middleware chain — including BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, and tracing — to subsequent HTTP/2 requests. Affected versions are Traefik v2.11.26 through v2.11.56 and v3.4.2 through v3.7.12; versions v2.11.57 and v3.7.13 contain the fix. The vulnerability was published on September 10, 2026, and carries a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling) and CWE-863 (Incorrect Authorization). Traefik's default proxy implementation (pkg/proxy/httputil) does not restrict which upgrade tokens are forwarded to backends — only WebSocket receives special handling via cleanWebSocketHeaders, but this is not an allowlist. When Connection: Upgrade is present, the Upgrade header (including h2c) and the connection-specific HTTP2-Settings header are passed downstream via pkg/middlewares/forwardedheaders/forwarded_header.go. If the backend accepts the h2c upgrade and returns 101 Switching Protocols, Go's net/http/httputil.ReverseProxy switches to tunnel mode, copying raw bytes between client and backend — at which point Traefik's router and middleware chain are no longer invoked for any subsequent HTTP/2 streams sent over that tunnel. Exploitation requires a backend that accepts Upgrade: h2c without validating the Connection header listing (common off-the-shelf servers were not exploitable in testing), an unprotected router pointing to the same backend as a protected router, and network access to Traefik (GitHub Advisory, Fix PR).

A network-accessible unauthenticated attacker can bypass all Traefik middleware protections — including BasicAuth, ForwardAuth, IPAllowList, and RateLimit — on any path served by a shared backend, by tunneling HTTP/2 requests through an unprotected route. This allows access to internal or administrative endpoints that were intended to be protected, potentially exposing sensitive data or enabling unauthorized actions. Additionally, tunneled requests do not appear in Traefik's access logs, metrics, or tracing pipeline, significantly hindering detection and incident response. The CVSS v4.0 scoring reflects high subsequent-system confidentiality and integrity impact (SC:H/SI:H) with no direct impact on the vulnerable system itself (GitHub Advisory, Feedly).

A detailed proof-of-concept (PoC) is included in the GitHub security advisory, demonstrating the full attack flow: a direct unauthenticated request to a protected /admin path returns 401 Unauthorized, while the same endpoint accessed over an h2c tunnel established through an unprotected /public path returns 200 OK with sensitive data. No evidence of in-the-wild exploitation has been reported, and the EPSS score is 0.0 at time of publication. The vulnerability is not listed in the CISA KEV catalog. Exploitation is constrained by the requirement that the backend must accept Upgrade: h2c and return 101 Switching Protocols — a condition not met by many modern off-the-shelf servers (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Traefik instances running affected versions (v2.11.26–v2.11.56 or v3.4.2–v3.7.12) exposed to the network. Determine if the backend accepts Upgrade: h2c by probing with an upgrade request.
2. Identify unprotected route: Enumerate Traefik routers to find a path (e.g., /public) that routes to the same backend as a protected path (e.g., /admin) but has no authentication middleware.
3. Verify protection on target path: Confirm the protected path returns 401 Unauthorized for unauthenticated direct requests: GET http://<traefik>:<port>/admin → 401.
4. Establish h2c tunnel via unprotected route: Open a raw TCP connection to Traefik and send an HTTP/1.1 upgrade request to the unprotected path:

GET /public HTTP/1.1
Host: x
Connection: Upgrade, HTTP2-Settings
Upgrade: h2c
HTTP2-Settings: AAMAAABkAAQAoAAAAAIAAAAA

5. Confirm tunnel establishment: If the backend accepts h2c, Traefik forwards the upgrade and the backend responds with HTTP/1.1 101 Switching Protocols, placing Traefik into raw tunnel mode.
6. Send HTTP/2 requests to protected paths over tunnel: Using an HTTP/2 client (e.g., Go's golang.org/x/net/http2 Transport.NewClientConn), send requests to the protected path (e.g., GET /admin) over the established tunnel connection. These requests bypass all Traefik middleware and reach the backend directly, returning 200 OK with protected content (GitHub Advisory).

• Network: Unusual TCP connections to Traefik entry points that begin with an HTTP/1.1 GET to an unprotected path containing Connection: Upgrade, HTTP2-Settings and Upgrade: h2c headers, followed by a long-lived raw TCP session (indicative of a tunnel).
• Network: Absence of expected HTTP/2 request logs for sensitive paths (e.g., /admin) despite backend access logs showing requests to those paths — indicating requests bypassed Traefik's logging pipeline.
• Logs: Traefik access logs showing a single 101 Switching Protocols response to an unprotected path (e.g., /public) with no subsequent logged requests to protected paths, while backend logs show access to those protected paths.
• Logs: Backend server logs recording HTTP/2 (HTTP/2.0) requests to protected endpoints (e.g., /admin) from Traefik's IP without corresponding Traefik access log entries.
• Network: Long-lived persistent TCP connections from external clients to Traefik on HTTP entry point ports, inconsistent with normal short-lived HTTP/1.1 request patterns (GitHub Advisory).

Upgrade Traefik to v2.11.57 or v3.7.13, which stop forwarding the Upgrade: h2c token and the HTTP2-Settings header to backends by wrapping the reverse proxy with a new h2cUpgradeHandler that strips these headers before proxying. Note that Traefik v3.4.2 through v3.6 are end-of-life and must be upgraded to v3.7.13. As a temporary workaround until patching is possible, restrict client access to the Traefik reverse proxy to trusted networks only, or ensure no backend in the deployment accepts Upgrade: h2c and returns 101 Switching Protocols. Operators who legitimately need h2c backend communication should use the explicit h2c:// service scheme or transportH2C configuration instead of relying on client-initiated upgrades (GitHub Advisory, v2.11.57 Release, v3.7.13 Release).

The Traefik maintainers (kevinpollet, sdelicata, mmatur) responded promptly, merging the fix PR on August 28, 2026, and releasing patched versions on September 4, 2026, approximately one week before the public advisory was published on September 10, 2026. The NixOS security tracker and Go vulnerability database (vulndb) both opened tracking issues referencing the fix PR shortly after disclosure. Community reaction in the Traefik GitHub repository was positive, with the v3.7.13 release receiving significant engagement (13+ thumbs-up reactions). No notable independent researcher commentary or media coverage beyond standard CVE aggregator reporting has been identified (Fix PR, v3.7.13 Release).