CVE-2026-88007

Executive Summary

CVE-2026-88007 is an authentication bypass affecting Traefik, an open source HTTP reverse proxy and load balancer, from version 2.11.0 until 2.11.57 and up to 3.7.12. The flaw resides in the HTTP/3 entrypoint's ConnContext: it fails to call service.AddTransportOnContext, causing kerberosRoundTripper to use a shared backend transport rather than a transport dedicated to each frontend connection. When HTTP/3 is enabled alongside a backend using connection-bound NTLM or Negotiate authentication with backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without holding victim credentials. This is a cross-client authentication bypass / session credential reuse condition (CWE-287) with high confidentiality and integrity impact; no public PoC, Nuclei template, or KEV listing is currently known, and no patch evidence has been independently confirmed by tracked patch sources.

Technical Analysis

Traefik is a reverse proxy that terminates client connections and forwards requests to backend services, maintaining pooled connections and per-request transport state. For connection-oriented authentication protocols such as NTLM (Windows Integrated Authentication) and Negotiate (SPNEGO/Kerberos), authentication is bound to the underlying TCP/HTTP connection: once a connection is authenticated as a given identity, subsequent requests sent over that same connection inherit that identity context.

The normal design intent in Traefik is for each frontend connection to obtain a transport dedicated to it, so that backend authentication state (including NTLM/Negotiate handshakes) cannot leak between unrelated clients. This is implemented by having the connection context (ConnContext) call service.AddTransportOnContext, which attaches a per-connection transport to the request context.

Per the NVD description, the HTTP/3 entrypoint's ConnContext omits this call. Because the HTTP/3 code path never invokes service.AddTransportOnContext, the Kerberos-aware round tripper (kerberosRoundTripper) falls back to a shared backend transport instead of a per-frontend-connection transport. The result is that the transport is not isolated per client.

The interlock required to trigger the bypass, as stated verbatim in the advisory, is:

1. HTTP/3 is enabled.
2. A backend uses connection-bound NTLM or Negotiate authentication.
3. Backend keep-alive is in use.

Under these conditions, the shared transport and keep-alive pooling mean an authenticated backend connection established on behalf of one client (the victim) can be selected to serve a request from a different, unauthenticated client. That second client "can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials."

This is a credential/authentication-context confusion vulnerability (CWE-287, Improper Authentication): rather than breaking cryptographic authentication, it breaks the binding between an authenticated connection and the client identity it was authenticated for. The vulnerability is confined to the HTTP/3 entrypoint path; the description attributes the defect specifically to the HTTP/3 ConnContext and its missing service.AddTransportOnContext invocation.

Only the function/identifier names present in the NVD description are cited here (ConnContext, service.AddTransportOnContext, kerberosRoundTripper); no additional internal function names, endpoints, or parameter names are asserted because none are provided in the source data.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-88007 (PoC status: None; Nuclei template: NO). The attack chain below is inferred strictly from the vulnerability class and the conditions enumerated in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a Traefik deployment acting as a reverse proxy in front of a Windows-integrated backend, where the HTTP/3 entrypoint is enabled and the backend enforces NTLM or Negotiate authentication with keep-alive connections. HTTP/3 exposure can be inferred from UDP/443 responsiveness (QUIC/HTTP/3 advertises via Alt-Svc headers on HTTP/1.1 and HTTP/2 responses). The victim population is any legitimate client that authenticates to the protected backend through Traefik using connection-bound Windows authentication.

2. Triggering the flaw class. The defect is a missing per-connection transport binding on the HTTP/3 code path. An attacker needs their request to be dispatched over a backend connection that was already authenticated for a victim. Because the shared transport lacks per-frontend-connection isolation, and backend keep-alive keeps authenticated connections alive in the pool, the authentication context established for the victim is not scoped to the victim's frontend connection. The attacker does not break authentication; they ride an already-authenticated connection. This is an authentication-context confusion / session reuse class of attack, not a cryptographic bypass.

3. Execution method at the vulnerability-class level. The attacker sends ordinary requests through the same HTTP/3 entrypoint toward the same backend, timed or arranged so that their request is served by a pooled, victim-authenticated backend connection. No crafted payload or memory-corruption primitive is described; the "exploit" is the connection-reuse behavior itself. Whether a given attempt succeeds is a race/timing matter dependent on connection pool state, connection reuse policy, and ongoing victim activity — hence the high attack complexity in the inferred CVSS vector and the conditional trigger set.

4. Post-exploitation impact. Upon inheriting the victim's authenticated backend context, the attacker can "read victim-only data, and act as that victim without the victim credentials." In practice this means access to resources and operations authorized to the victim identity on the backend — confidentiality of victim-only data and integrity of actions performed as the victim. Scope may extend beyond the Traefik instance because the backend's trust in the connection is what is being abused.

Note: no public exploit exists, so no specific packet sequence, payload bytes, or tooling is documented. Any lab reproduction would require standing up HTTP/3, an NTLM/Negotiate backend with keep-alive, an authenticated victim session, and a concurrent unauthenticated client, then observing whether the unauthenticated client receives victim-scoped responses.

Impact Assessment

The vulnerability is an authentication bypass yielding unauthorized access as another user (CWE-287). Impact dimensions:

• Confidentiality: HIGH. The attacker can read victim-only data returned over a backend connection authenticated as the victim.
• Integrity: HIGH. The attacker can "act as that victim," performing operations the victim identity is authorized to perform, without the victim credentials.
• Availability: No availability impact is described in the source data; availability is not asserted.
• Scope: The flaw is in Traefik but the abused trust is the backend's, so impact crosses the component boundary (scope change), consistent with the inferred vector.

The inferred CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N reflects: network-exploitable (AV:N), high complexity due to the conditional trigger set and pooled-connection race (AC:H), no privileges required (PR:N), no user interaction (UI:N), changed scope (S:C), and high confidentiality/integrity with no availability impact. No official CVSS score or vector was assigned in the provided data (CVSS Score: N/A); the vector above is an assessment, not a vendor or NVD-published value. EPSS has not been scored by FIRST.org and no value is stated.

Blast radius: organizations running Traefik with the HTTP/3 entrypoint enabled in front of Windows-integrated (NTLM/Negotiate) backends with keep-alive. Environments using HTTP/1.1 or HTTP/2 only, or backends without connection-bound authentication, are not described as affected. Because deployment-specific factors gate exploitation, the population at risk is a subset of Traefik users rather than all of them. No threat actor campaigns or exploit-in-the-wild evidence are known for this CVE.

Detection Guidance

Because this is a connection-reuse/authentication-context confusion defect rather than a payload-based attack, detection centers on anomalous identity/connection reuse and on HTTP/3 entrypoint behavior. The rules below are detection scaffolding; they should be tuned to the environment, since no exploit signature exists to match.

Sigma Rule

title: Potential Traefik HTTP/3 Backend Authentication Context Reuse (CVE-2026-88007)
id: 8b1f0c2a-4d3e-4a7b-9c10-77e6a2c1b9d4
status: experimental
description: Detects candidate exploitation of CVE-2026-88007 where an unauthenticated HTTP/3 client appears to receive or act on a backend connection authenticated for a different identity.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88007
author: valtersit.com
date: 2026/01/01
logsource:
  category: web
  product: traefik
detection:
  selection_entrypoint:
    EntryPointName|contains: 'http3'
  selection_auth_mismatch:
    - 'AuthUser|exists: false'
    - 'BackendAuthUser|exists: true'
  condition: selection_entrypoint and selection_auth_mismatch
falsepositives:
  - Legitimate proxying of pre-authenticated backends
  - Logging gaps where frontend identity is not recorded
level: high
tags:
  - attack.t1190
  - cve.2026.88007

Note: Traefik access-log field names vary by version; map EntryPointName/BackendAuthUser to your actual log schema before deployment.

YARA Rule

rule CVE_2026_88007_Traefik_HTTP3_Transport_Context
{
    meta:
        description = "Placeholder detection for Traefik HTTP/3 entrypoint missing AddTransportOnContext (CVE-2026-88007). Matches config artifacts, NOT a memory exploit signature."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88007"
        date = "2026-01-01"
        severity = "high"
    strings:
        $h3 = "http3" ascii nocase
        $ep = "entryPoints" ascii nocase
        $cfg = "traefik" ascii nocase
        $ver1 = "2.11." ascii
        $ver2 = "3.7." ascii
    condition:
        uint16(0) == 0x0a0d or filesize < 5MB
        and $h3 and $ep and $cfg and ($ver1 or $ver2)
}

This rule is intended to flag Traefik configuration files that enable HTTP/3 on affected version ranges, aiding asset inventory of at-risk instances. YARA cannot detect the in-memory connection-reuse condition itself.

Suricata IDS Rule

alert quic any any -> any any (msg:"CVE-2026-88007 Traefik HTTP/3 potential backend auth context reuse - suspicious Alt-Svc to h3"; flow:to_client; content:"alt-svc"; nocase; content:"h3"; nocase; classtype:policy-violation; reference:cve,2026-88007; sid:2026880071; rev:1;)

alert http any any -> any any (msg:"CVE-2026-88007 Traefik Negotiate/NTLM auth header observed on proxied stream"; flow:to_server; content:"Authorization|3a 20|"; http_header; pcre:"/^Authorization:\s*(NTLM|Negotiate)/mi"; classtype:policy-violation; reference:cve,2026-88007; sid:2026880072; rev:1;)

These rules provide visibility into HTTP/3 advertisement and connection-bound auth header usage; they will not by themselves confirm exploitation, which requires correlating frontend client identity against backend-authenticated identity.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where quic.request.headers contains "negotiate" or quic.request.headers contains "ntlm" ]
  [ network where quic.response.status == 200 and not quic.request.headers contains "authorization" ]

This EQL sequence looks for a client sending no authorization header but receiving a successful response in the vicinity of Negotiate/NTLM activity, which is consistent with riding an authenticated pooled connection. Field names must be mapped to the ENR/dataset schema in use.

Splunk SPL Query

index=traefik sourcetype=traefik:access
| eval ep_lower=lower(entrypoint)
| where like(ep_lower, "%http3%") OR like(ep_lower, "%quic%")
| eval has_client_auth=if(isnotnull(authorization) OR isnotnull(Authorization), 1, 0)
| eval backend_identity_used=if(match(_raw, "(?i)(NTLM|Negotiate)") AND has_client_auth=0, 1, 0)
| stats count values(uri) as uris values(backend_identity_used) as reuse_flags by src, ep_lower
| where reuse_flags > 0
| sort - count

Adjust field references to the actual Traefik access-log extraction in your Splunk deployment; the intent is to surface HTTP/3 requests that appear to benefit from backend Negotiate/NTLM authentication without carrying client credentials.

Wazuh OSSEC Rule

<group name="traefik,cve-2026-88007,">
  <rule id="2026880" level="12">
    <decoded_as>json</decoded_as>
    <field name="EntryPointName">\.*(http3|quic)\.*</field>
    <field name="Authorization" negate="yes" type="pcre2">.*</field>
    <description>CVE-2026-88007: HTTP/3 entrypoint request without client auth against NTLM/Negotiate backend (possible connection reuse)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
  <rule id="2026881" level="10">
    <if_sid>2026880</if_sid>
    <field name="BackendAuthScheme">\.*(NTLM|Negotiate)\.*</field>
    <description>CVE-2026-88007: backend connection-bound auth observed while frontend lacks credentials</description>
    <group>authentication_bypass,</group>
  </rule>
</group>

Decoder/field names (e.g., EntryPointName, BackendAuthScheme) must be aligned to the Traefik log JSON decoder configured in Wazuh; they are illustrative field mappings, not guaranteed schema names.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor fix and workarounds were not provided in the intelligence data (Vendor Fix: N/A; Workarounds: N/A).

1. Immediate mitigations

   • Disable the HTTP/3 entrypoint (or do not expose QUIC/UDP 443) for Traefik instances fronting backends that use connection-bound NTLM or Negotiate authentication. The vulnerability is specific to the HTTP/3 ConnContext path per the advisory, so removing that entrypoint eliminates the described trigger.
   • Disable backend keep-alive to the affected NTLM/Negotiate backend so authenticated connections are not pooled and reused across clients. This directly removes the reuse precondition stated in the advisory.
   • If neither is feasible in the short term, place the Windows-integrated backend behind an authentication mechanism that is not connection-bound (for example, a scheme that carries identity per request) so that a reused connection cannot confer another user's identity. Validate any such change against application behavior before rollout.
   • Restrict network access to the HTTP/3 entrypoint to trusted clients only, reducing the population that could race for a pooled authenticated connection.

2. Patch / upgrade steps

   • Per the NVD description, the issue is fixed in Traefik 2.11.57 and 3.7.13. Upgrade affected 2.11.x deployments to 2.11.57 or later, and affected 3.x deployments to 3.7.13 or later.
   • Because patch confidence is 0/4 and no vendor advisory or patch artifact was independently verified from tracked sources, validate the fixed versions against the official Traefik release notes and changelog before relying on them, and confirm the specific service.AddTransportOnContext fix in the HTTP/3 entrypoint is present in the build you deploy.
   • Treat "2.11.0 until 2.11.57" strictly as the advisory's stated range; deployments on 2.11.57+ or 3.7.13+ are described as fixed.

3. Long-term hardening

   • Avoid connection-bound authentication schemes at the proxy/backend boundary where an alternative per-request identity mechanism is available; connection-bound auth is inherently sensitive to connection reuse semantics.
   • Maintain an inventory of Traefik instances and their enabled entrypoints/protocols (HTTP/1.1, HTTP/2, HTTP/3) so protocol-specific defects can be scoped and remediated quickly.
   • Monitor Traefik release notes and security advisories; keep the proxy within supported, current minor versions to reduce exposure windows between disclosure and patch.
   • Instrument access and backend authentication logs to correlate frontend client identity with backend-authenticated identity, enabling detection of future connection-context confusion issues.

References

• NVD — CVE-2026-88007: https://nvd.nist.gov/vuln/detail/CVE-2026-88007
• Traefik security advisories / releases (verify 2.11.57 and 3.7.13 fix notes): https://github.com/traefik/traefik/releases
• Traefik documentation — HTTP/3 and entrypoints configuration: https://doc.traefik.io/traefik/
• FIRST.org EPSS (no score currently published for CVE-2026-88007): https://www.first.org/epss/
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html

Threat actor campaigns / exploit-in-the-wild: None known. CISA KEV: NO. No public PoC, exploit code, or Nuclei template was identified in the provided data.