CVE-2026-88009: 
NixOS vulnerability analysis and mitigation

CVE-2026-88009 is an authorization bypass vulnerability in Traefik, an open-source HTTP reverse proxy and load balancer, caused by improper handling of rootless HTTP/1 request targets. When Traefik receives a request with a rootless target (e.g., GET http:http://internal-vhost/admin HTTP/1.1), Go's URL parser stores the target in URL.Opaque while leaving URL.Path empty; Traefik then evaluates routing, middleware, and access logging against a normalized path of /, but forwards the original opaque target verbatim to the backend. This enables cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion. Affected versions are Traefik prior to 2.11.57 and versions 3.0.0 through 3.7.12; versions 3.0–3.6 are end-of-life and will not receive independent fixes. The vulnerability carries a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests) and CWE-1286 (Improper Validation of Syntactic Correctness of Input). Go's url.ParseRequestURI populates URL.Opaque for rootless request targets (e.g., http:http://internal-vhost/admin) while leaving URL.Path, URL.RawPath, and URL.Host empty. Traefik's entry-point pipeline — including denyFragment, normalizePath, sanitizePath, the muxer's withRoutingPath, the encodedCharacters middleware, forwardAuth, and the access logger — all derive the path from URL.EscapedPath() or URL.RawPath, which return / for opaque URLs, so all guards evaluate against /. However, URL.RequestURI() gives Opaque precedence over the path when forwarding, so the backend receives the attacker's original target byte-for-byte. The bug affects both the standard pkg/proxy/httputil/proxy.go and the experimental fast proxy pkg/proxy/fast/proxy.go. Exploitation requires a backend that interprets a rootless target as a path (e.g., fasthttp-based servers, Python's http.server); common backends like nginx, Apache httpd, Node.js/llhttp, and Tomcat reject such requests with HTTP 400 (GitHub Advisory, Fix PR).

Successful exploitation allows an unauthenticated network attacker to bypass path-scoped authorization controls (including forwardAuth middleware policies), route requests to internal virtual hosts that are not intended to be publicly accessible, and evade access logging — all simultaneously and without any non-default configuration. Confidentiality impact is high, as protected backend resources (e.g., admin panels, internal APIs) can be accessed without credentials; integrity impact is low, as the attacker can make unauthorized requests to backend services. Notably, even explicitly enabled hardening such as encodedCharacters.allowEncodedSlash=false is structurally bypassed by this technique, and all malicious requests are logged identically as GET / HTTP/1.1, severely hampering incident detection (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability is exploitable by unauthenticated attackers over the network with no user interaction required, and NVD's SSVC assessment marks it as automatable. The EPSS score is 0.0, reflecting the current absence of observed exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Traefik instances running versions prior to 2.11.57 or between 3.0.0 and 3.7.12 using tools like Shodan or Censys. Determine the backend server technology to confirm it accepts rootless request targets (e.g., fasthttp-based applications or Python's http.server).
2. Craft a rootless HTTP/1 request target: Construct an HTTP/1.1 request using a raw TCP socket (standard HTTP clients will not emit this form) with a rootless target such as GET http:http://internal-vhost/admin HTTP/1.1. The scheme followed by a non-slash string causes Go to store the value in URL.Opaque.
3. Send the request through Traefik: Transmit the raw request with a Host: header matching a configured Traefik router (e.g., Host: app.example.com). Traefik's routing evaluates the path as / and matches a host-only or PathPrefix(/) router, bypassing any path-scoped guards.
4. Achieve authorization bypass: Traefik forwards the opaque target verbatim to the backend. The backend (if lenient) interprets http://internal-vhost/admin as a path, serving the protected resource. A forwardAuth middleware receives X-Forwarded-Uri: http://internal-vhost/admin, which matches no prefix-based deny rule and fails open.
5. Evade access logging: All such requests are recorded in Traefik's access log as GET / HTTP/1.1, making forensic detection extremely difficult. Encoded payloads (e.g., admin%2f..%2fsecret) also bypass encodedCharacters filtering and are forwarded to the backend intact (GitHub Advisory).

• Network: Unexpected HTTP/1.1 requests to Traefik entry points where the raw request line contains a rootless target (e.g., GET http:http://internal-vhost/admin HTTP/1.1 or GET http:admin/secret HTTP/1.1); these can only be observed via network-level packet capture (e.g., tcpdump/Wireshark) since Traefik's access log will not reflect them accurately.
• Logs: Traefik access logs showing a high volume of GET / HTTP/1.1 entries with successful (2xx) responses to backend services that would not normally serve content at /; DEBUG-level Traefik logs (post-patch) showing Rejecting request because it has an opaque URL messages, which indicate exploitation attempts against patched instances.
• Backend Logs: Backend server logs (e.g., fasthttp, Python http.server) recording requests with unusual RequestURI values such as http://internal-vhost/admin or admin/secret originating from the Traefik proxy IP, especially for paths that should be access-controlled.
• Behavioral: Successful responses to internal virtual host resources from external clients that should not have access; forwardAuth service logs showing authorization decisions of 200 OK for requests where the X-Forwarded-Uri header contains an authority-bearing URI rather than a normal path (GitHub Advisory).

Upgrade Traefik to version 2.11.57 or 3.7.13 (or later), which introduce a denyOpaque handler at the entry-point chain that rejects any request with a non-empty URL.Opaque with a 400 Bad Request response; the fix also clears URL.Opaque in the proxy layer as a defense-in-depth measure (v2.11.57 Release, v3.7.13 Release). Users on Traefik v3.0–v3.6 (end-of-life) must upgrade to v3.7.13, as no backport will be provided for those branches. As an interim workaround where immediate patching is not possible, implement network-level controls (e.g., WAF rules, upstream firewall) to block HTTP/1.1 requests whose request line contains a scheme followed by a non-slash character sequence. Review backend access logs for evidence of exploitation that may have evaded Traefik's access logging (GitHub Advisory).

The Traefik maintainers (kevinpollet, mmatur, sdelicata) responded promptly, merging the fix PR on August 28, 2026, and releasing patched versions on September 4, 2026 (Fix PR, v3.7.13 Release). The advisory notes that the vulnerability was discovered by an external automated code scanner and was independently reproduced end-to-end on the GA release image, lending high confidence to the finding. The community response to the v3.7.13 release was positive, with the release receiving numerous reactions on GitHub. No significant independent researcher commentary or media coverage beyond the official advisory has been identified at this time.