CVE-2026-88007

Traefik Proxy versions 2.11.0 up to (but excluding) 2.11.57, and 3.x versions before 3.7.13, fail to register a per-frontend-connection transport context for the HTTP/3 entrypoint (the entrypoint ConnContext never calls service.AddTransportOnContext), so the kerberosRoundTripper falls back to a shared backend transport instead of a dedicated one. The flaw is triggered when HTTP/3 is enabled, the backend uses connection-bound NTLM or Negotiate authentication, and backend keep-alive is active. In that configuration, an unrelated client can be served over a backend connection already authenticated as a victim, letting the attacker read victim-only data and act as that victim without any victim credentials. This is an authentication/authorization confusion issue (CWE-287, CWE-863) affecting only Traefik deployments that combine those settings. No public proof-of-concept is known, the issue is not in CISA KEV, and there are no reports of exploitation in the wild; fixed releases are 2.11.57 and 3.7.13.

What to do: Upgrade Traefik to 2.11.57 on the 2.x line or 3.7.13 on the 3.x line (or later). As interim mitigation, disable HTTP/3 on affected entrypoints, or avoid connection-bound NTLM/Negotiate backend authentication or backend keep-alive for those backends. Audit entrypoint configurations for HTTP/3 enabled and identify backends using NTLM or Negotiate authentication to confirm whether your deployment is exposed.