CVE-2026-88008 is a critical (CVSS 9.1) request smuggling flaw in Traefik. A client can ask for an h2c upgrade, and if the backend accepts it, Traefik stops applying routers and middleware to later requests on that connection. Traefik 2.11.57 and 3.7.13 fix it, so upgrade.
What's affected
The GitHub advisory lists:
- Traefik v3: from 3.4.2 up to 3.7.12, fixed in 3.7.13
- Traefik v2: from 2.11.26 up to 2.11.56, fixed in 2.11.57
The advisory adds that v3.4.2 through v3.6 are end of life and are also affected, so users on those lines must move to 3.7.13.
Exposure needs a backend that honours the h2c upgrade without checking the connection header properly and answers 101 Switching Protocols. The advisory says common off-the-shelf servers were not exploitable in its testing, so the practical risk depends on your backend software.
How to check if you're exposed
Check the version:
traefik version
Then look at your backends. Which servers sit behind Traefik, and do any of them accept an upgrade to cleartext HTTP/2? Test that in a non-production copy and read the backend documentation. Pay most attention to setups where one backend serves both a public route and a protected route, for example a public path and an admin path on the same service, since the advisory describes the bypass in exactly that layout.
What to do now
- Upgrade Traefik to 2.11.57 or 3.7.13, or later.
- If you run an end of life v3 release, plan the move to 3.7.13, since older v3 lines are affected and not patched.
- Where possible, split public and protected routes onto different backend services.
- Add authentication at the backend as a second layer for admin paths.
- Check logs and metrics gaps, since the advisory says requests in the tunnel skip access logging, metrics and tracing.
Why it matters
The record lists CWE-444 (inconsistent interpretation of HTTP requests) and CWE-863 (incorrect authorization). After Traefik moved to unencrypted HTTP/2 with prior knowledge, a client-sent upgrade request and its settings header were forwarded to the backend. If the backend agreed, Traefik switched into a raw byte tunnel. From then on, requests inside the tunnel never passed through routers, so authentication, address allow lists and rate limits did not run.
The fix stops forwarding the h2c upgrade token and the settings header. WebSocket upgrades are unaffected.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Is my WebSocket traffic affected by the fix?
No. The advisory says Upgrade: websocket is unaffected.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
- https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326
- https://github.com/traefik/traefik/releases/tag/v2.11.57
- https://github.com/traefik/traefik/releases/tag/v3.7.13
Last reviewed: 19 October 2026.
