CVE-2026-88009

Traefik Proxy mishandles rootless HTTP/1 request targets, which Go stores in the URL.Opaque field while leaving URL.Path empty. As a result, routing, path sanitization, forwardAuth, encoded-character handling, and access logging are evaluated against a path normalized to "/", while the raw opaque target is forwarded verbatim to the backend. A remote, unauthenticated attacker can send such a crafted request to achieve a cross-vhost routing bypass, bypass path-scoped authorization controls, and evade access-log entries, provided the backend interprets the opaque target as a path. All Traefik deployments running 2.x versions before 2.11.57 or 3.x versions before 3.7.13 are affected, especially those using multiple hosts or path-based routing and authorization rules. No public proof-of-concept or known exploitation exists, and the issue is not in CISA KEV.

What to do: Upgrade Traefik to 2.11.57 on the 2.x branch or 3.7.13 on the 3.x branch. Prioritize deployments that use path-scoped routers, forwardAuth middleware, or multiple hosts, and review access logs and backend paths for requests forwarded with unusual rootless targets. Because no workaround is provided in the advisory data, upgrading is the primary remediation; additionally confirm that backends normalize request targets rather than trusting forwarded paths.