Bug 2531489 (CVE-2026-88008) - CVE-2026-88008 github.com/traefik/traefik: Traefik: Incorrect authorization due to HTTP/2 protocol confusion
Summary: CVE-2026-88008 github.com/traefik/traefik: Traefik: Incorrect authorization d...
Keywords:
Status: NEW
Alias: CVE-2026-88008
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-10 15:08 UTC by OSIDB Bzimport
Modified: 2026-09-22 15:12 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-10 15:08:10 UTC
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.


Note You need to log in before you can comment on or make changes to this bug.