CVE-2026-88004

Traefik, an open-source HTTP reverse proxy and load balancer, fails to validate HTTP trailers in its entrypoint defenses between versions 3.2.0 and 3.7.13: the aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders protections inspect req.Header but not req.Trailer, allowing an unauthenticated remote client to place an aliasing or trusted header name into an HTTP/1.1 chunked trailer or an HTTP/2 trailer. When the retry or buffering middleware reads the request body before the reverse proxy clones the request, the attacker-controlled trailer value reaches a backend that merges trailers into the header namespace, bypassing the documented delete or reject behavior. An attacker can thereby spoof identity or forwarded routing headers at the backend — for example injecting trusted forwarded or identity headers — potentially impersonating users or altering routing decisions on subsequent systems. Affected deployments are Traefik 3.2.0 through versions prior to 3.7.13 that use these entrypoint strategies, especially where retry or buffering middleware is configured and backends trust merged header/trailer values; the high attack complexity in the CVSS 4.0 score (7.0, High) reflects these required conditions. There is currently no known exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV; it is fixed in Traefik 3.7.13.

What to do: Upgrade Traefik to 3.7.13 or later, which is the only version identified as fixed in the advisory data. Until patched, review entrypoint configurations for use of aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders trust, and consider disabling or tightening these on routes where the retry or buffering middleware reads request bodies, or ensure backends do not merge trailers into the header namespace for identity/forwarded headers. No CISA KEV listing or public proof-of-concept exists, so prioritize patching deployments where backends trust forwarded or identity headers.