CVE-2026-88007: Critical HTTP/3 NTLM Session Mixup in Traefik

CVE-2026-88007 is a critical (CVSS 9.1) flaw in the Traefik reverse proxy. With HTTP/3 on, a backend that binds NTLM or Negotiate login to a connection, and keep-alive, one client can inherit another client's identity. Traefik 2.11.57 and 3.7.13 fix it, so upgrade.

What's affected

The GitHub advisory lists these affected ranges:

• Traefik v3: from 3.0.0 up to 3.7.12, fixed in 3.7.13
• Traefik v2: from 2.11.0 up to 2.11.56, fixed in 2.11.57

Not every deployment is exposed. The advisory says exposure needs all of these at once: HTTP/3 enabled on the entrypoint, a backend that uses connection-bound NTLM or Negotiate (Kerberos) authentication, and backend keep-alive. Deployments that use ordinary per-request authentication are not affected.

How to check if you're exposed

Check the version first.

traefik version

For containers, run the same command inside the container, or read the image tag. Then check the three conditions:

• Search your static configuration for an entrypoint with HTTP/3 enabled, for example a section that mentions http3.
• Find backends that use Windows integrated authentication such as NTLM or Negotiate. Intranet sites, SharePoint style apps and some legacy services use it.
• Confirm whether the backend connection pool keeps connections alive, which is the default for most setups.

If all three apply, treat the system as exposed.

What to do now

1. Upgrade Traefik to 2.11.57 or 3.7.13, or later.
2. If you cannot upgrade at once, consider turning HTTP/3 off on entrypoints that serve NTLM or Negotiate backends. This removes one of the three conditions the advisory lists.
3. Review backends that use connection-bound authentication and note which routes reach them.
4. Look in backend logs for requests acting as a user from a client that never logged in, if you can correlate them.
5. Add the proxy version to your inventory so future advisories find it.

Disabling HTTP/3 has side effects. Clients that use it fall back to HTTP/2 or HTTP/1.1, which works, but check that nothing in your environment depends on it. Treat the change as a stopgap and apply the upgrade as soon as your release process allows.

The fix is also a good reminder of a general point. When a proxy supports several protocols, each protocol path needs the same safety logic. The advisory calls this a protocol parity gap: HTTP/1.1 and HTTP/2 created the per-connection transport state, and the HTTP/3 path did not.

Why it matters

The record lists CWE-287 (improper authentication) and CWE-863 (incorrect authorization). Connection-bound authentication ties a user's identity to one TCP connection to the backend, not to each request. To stay safe, a proxy must give each front-end client its own backend connection. The advisory says the HTTP/3 path never set up that per-client state, so the proxy used a shared pool, and a client could be handed a backend connection that was already logged in as someone else.

The result is that an unrelated client could read data meant for the victim and act in their name, without their credentials. The advisory notes that the HTTP/1.1 and HTTP/2 paths behave correctly.

The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.

Try it yourself

Three conditions must line up here. A check of which ones hold in your environment tells you how urgent the upgrade is.

Click through it at your own pace, or open it full screen.

Quick check

If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.

Sources

Fetched for this guide:

• https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

Last reviewed: 19 October 2026.