CVE-2026-88011 is a high severity header identity spoofing flaw in Traefik, scored 8.1. Traefik 2.11.56 and 3.7.12. Check your installed version against the affected list below, then patch or restrict access until you can. The record does not flag it as exploited.
What's affected
- Traefik before 2.11.56.
- Traefik from 3.0.0 until 3.7.12.
Severity in the record: High (8.1), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. Weakness: CWE-290.
Fix: Traefik 2.11.56 and 3.7.12. The aliasHeadersStrategy option is off by default and must be set to delete or reject.
How to check if you're exposed
- Run
traefik versionor check your container image tag. - Search your static configuration for aliasHeadersStrategy:
grep -rn aliasHeadersStrategy /etc/traefik. - Identify backends built on CGI, WSGI, PHP or NGINX that read identity headers.
Run these on every host, image and build that could carry the component. Dependency files in repositories and base images in registries are easy to miss.
What to do now
- Confirm the version of every affected system using the checks above.
- Read the vendor advisory linked in Sources and note the fixed version for your release line.
- Schedule the update, starting with systems that face untrusted networks or hold the most sensitive data.
- In the meantime: set aliasHeadersStrategy to delete or reject after upgrading. The fix does nothing until you do.
- Record the change, then recheck the version to confirm it took effect.
Why it matters
A client-supplied header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy, because Go treats it as different from X-Authenticated-User. Backends that normalize names into variables collapse the two, so they may read the client value instead of the identity Traefik asserted. The weakness is CWE-290, authentication bypass by spoofing, and it affects any header Traefik manages. A related CVE, CVE-2026-88879, covers the same advisory.
The record's KEV flag is false, so this post makes no claim that the flaw is exploited in the wild. That can change, so recheck the CISA catalog from time to time.
Libraries like this often arrive as transitive dependencies, so the version in your lockfile may not be one you chose. Safeguard's free in-browser dependency scan can show whether the package is in a project, and reachability analysis helps separate code paths that call the weak function from those that never do.
The vector string in the record is a compact summary of how the flaw is reached and what it costs. AV is the attack vector (network, adjacent or local), PR is the privilege the attacker needs, and the C, I and A letters give the impact on confidentiality, integrity and availability. Read it against your own network layout rather than relying on the score alone.
After you patch
Patching is not the end of the job. Recheck the version on each system, because an upgrade that failed or rolled back looks the same as a success until someone looks. Keep the advisory link with your change record so the next reviewer can see why the update happened.
If you cannot patch soon, write down the reason, the compensating control you chose and a date to revisit. Exceptions without a date tend to become permanent.
Quick check
Is upgrading alone enough?
No. The record says the protection is disabled by default and must be configured as delete or reject.
Sources
-
Traefik: GHSA-rf44-j88r-hh8c
-
Safeguard Gold: CVE-2026-88011
Last reviewed: 18 October 2026.
