CVE-2026-88007
Traefik HTTP/3 backend connection reuse across users - the HTTP/3 entrypoint's ConnContext never calls service.AddTransportOnContext, so a backend connection already authenticated by one client (NTLM/Negotiate, which authenticate the CONNECTION not the request) is handed to the next client and the backend answers as the first user (CVSS 9.1)
- Severity
- critical
- Affected product
- Traefik
- Affected versions
- Traefik ≥ 2.11.0, < 2.11.57
- Affected versions
- Traefik ≥ 3.0.0, < 3.7.13
- Fixed in
- Traefik 2.11.57
- Fixed in
- Traefik 3.7.13
- Added to NewScan
- 2026-09-11
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
APPLIANCE FINGERPRINT
NewScan fingerprints the Traefik appliance and reports this CVE when the detected version falls inside the affected range below.
Added 2026-09-11. GHSA-qqjf-53cj-pwvv, ranges from the advisory API: v2 `>= 2.11.0, < 2.11.57` and v3 `>= 3.0.0, < 3.7.13`. TWO arms with no patched gap inside either - unlike CVE-2026-71324 this fix did not land on a 3.6.x branch, so the 3.x arm is one unbroken range. This is the 2.x arm; ge 2.11.0 is the advisory's own lower bound, not the ge 2.0.0 convention used where an advisory states none.
APPLIANCE FINGERPRINT
NewScan fingerprints the Traefik appliance and reports this CVE when the detected version falls inside the affected range below.
The 3.x arm of CVE-2026-88007 (see the 2.x row). MEASURED 2026-09-11 against traefik:v3.7.11 --api.insecure=true on loopback: GET /api/version -> 200 {"Version":"3.7.11","Codename":"langres","startDate":"..."}, inside this row - and 3.7.11 matched NO Traefik row before today, so this batch is the whole reason a current-but-unpatched Traefik is now reported. Negative case measured the same day on traefik:v3.7.13: /api/version reports 3.7.13, outside every row in this file.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →