CVE-2026-88877

Executive Summary

CVE-2026-88877 is a critical authentication bypass and middleware-stripping vulnerability in Traefik's Kubernetes ingress-nginx provider, affecting versions v3.7.0 through v3.7.11. When an Ingress is configured with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation, Traefik creates a 'sibling' router that matches only on the host, retains the RedirectRegex middleware, and still forwards to the protected backend service. A specially crafted request using a non-numeric or empty port (e.g., Host: www.example.com:x) bypasses the redirect pattern and reaches the backend with none of the Ingress's annotation-derived middlewares applied—including authentication and source-IP allowlisting. With a CVSS score of 9.8, this vulnerability allows unauthenticated remote attackers to fully compromise the confidentiality, integrity, and availability of protected backend services.

Technical Analysis

The vulnerability resides in Traefik's Kubernetes ingress-nginx provider, which translates Kubernetes Ingress resources into Traefik routers and middlewares. In affected versions (v3.7.0 through v3.7.11), when an Ingress carries both an authentication annotation (such as BasicAuth) and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation, the provider generates an additional 'sibling' router. This sibling router matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service.

The core flaw is twofold. First, RedirectRegex is not a terminal handler—if a request does not match the redirect pattern, it is forwarded to the backend rather than being rejected. Second, the redirect pattern only accepts a numeric port, whereas Traefik's host matcher canonicalizes the authority via net.SplitHostPort. This discrepancy means that a request with a non-numeric or empty port (for example, Host: www.example.com:x) selects the sibling router, fails to match the redirect pattern, and is proxied directly to the protected backend service.

Critically, because the sibling router carries only the RedirectRegex middleware, none of the Ingress's annotation-derived middlewares are applied. This includes not only authentication mechanisms (e.g., BasicAuth) but also every other annotation-derived middleware such as source-IP allowlisting. The result is a complete bypass of the security controls that the Ingress author intended to enforce. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), as the attacker controls the Host header—specifically the port component—to select a router path that omits authorization enforcement.

The attack surface is any Traefik deployment running v3.7.0–v3.7.11 with the Kubernetes ingress-nginx provider enabled and at least one Ingress configured with both an authentication annotation and the from-to-www-redirect annotation. Traefik v2 and v3 releases before v3.7.0 are not affected.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/target identification: An attacker identifies a Traefik instance acting as a reverse proxy for Kubernetes-hosted services. This can be done by observing HTTP response headers (e.g., Server: Traefik), fingerprinting the Traefik dashboard if exposed, or simply interacting with publicly reachable services that are fronted by Traefik. The attacker identifies a host that is protected by an authentication annotation and is also configured with the nginx.ingress.kubernetes.io/from-to-www-redirect annotation—typically a www-to-non-www redirect.

2. Triggering the flaw: The attacker sends an HTTP request to the target host but malforms the Host header by appending a non-numeric or empty port, for example Host: www.example.com:x or Host: www.example.com:. Because Traefik's host matcher canonicalizes the authority via net.SplitHostPort, the host portion still matches the sibling router's host-only matcher. However, the RedirectRegex pattern—which only accepts a numeric port—fails to match, so the request is not redirected.

3. Payload/execution method: Because RedirectRegex is not a terminal handler, the non-matching request falls through and is proxied to the parent router's protected backend service. Crucially, the sibling router carries only the RedirectRegex middleware, so none of the parent Ingress's annotation-derived middlewares (BasicAuth, source-IP allowlisting, etc.) are applied. The attacker's request therefore reaches the backend unauthenticated and unconstrained.

4. Post-exploitation impact: The attacker gains unauthenticated access to the protected backend service. Depending on the service, this could allow reading sensitive data, invoking privileged functionality, or modifying application state—all without presenting credentials or originating from an allowlisted source IP. The CVSS vector reflects high confidentiality, integrity, and availability impact, meaning the attacker can effectively operate as an authorized user.

Impact Assessment

The CVSS 3.1 base score is 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack is network-reachable (AV:N), requires no special conditions or privileges (AC:L, PR:N), needs no user interaction (UI:N), and has scope unchanged (S:U). Confidentiality, integrity, and availability are all rated High, meaning a successful exploit can fully compromise the protected backend service.

Business impact includes unauthorized access to internal or protected applications, potential data exfiltration, tampering with application data, and service disruption. Because the bypass discards all annotation-derived middlewares—not just authentication—organizations that rely on source-IP allowlisting as a defense-in-depth control are equally exposed. The blast radius is any Kubernetes cluster running Traefik v3.7.0–v3.7.11 with the ingress-nginx provider and the relevant annotation combination. The EPSS score is not yet available; CISA KEV status is NO, and no public exploit code or Nuclei template exists at this time.

Detection Guidance

Sigma Rule

title: Traefik ingress-nginx Authentication Bypass via Malformed Host Port
id: 8f4c2b1a-7d3e-4a9f-b6c2-1e5d9f0a3b7c
status: experimental
description: Detects requests to Traefik with non-numeric or empty port in Host header targeting the sibling router created by the from-to-www-redirect annotation, bypassing authentication middlewares.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88877
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: traefik
detection:
  selection_host_port:
    cs-host|re: '^[a-zA-Z0-9.-]+:(?!\d+$).*$'
  selection_host_empty_port:
    cs-host|endswith: ':'
  condition: selection_host_port or selection_host_empty_port
fields:
  - cs-host
  - cs-uri
  - c-ip
falsepositives:
  - Legitimate clients sending malformed Host headers
level: high
tags:
  - attack.t1190
  - cve.2026.88877

YARA Rule

rule CVE_2026_88877_Traefik_Host_Port_Bypass
{
    meta:
        description = "Detects HTTP requests with malformed Host header port targeting Traefik CVE-2026-88877"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88877"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $host_hdr = "Host: " ascii nocase
        $port_sep = ":" ascii
        $www = "www." ascii nocase
        $http_get = "GET " ascii
        $http_post = "POST " ascii
        $http_head = "HEAD " ascii

    condition:
        ($http_get or $http_post or $http_head) and $host_hdr and $www and
        for any i in (1..#host_hdr) : (
            $port_sep at (@host_hdr[i] + 6 + 10)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88877 Traefik ingress-nginx Authentication Bypass via Malformed Host Port"; flow:to_server,established; http.host; content:":"; pcre:"/^[a-zA-Z0-9.-]+:(?!\d+$)/R"; classtype:attempted-admin; reference:cve,2026-88877; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88877; sid:202688877; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method in ("GET", "POST", "HEAD") and
   http.request.headers.Host regex~ "^[a-zA-Z0-9.-]+:(?!\\d+$)"]
  [network where http.request.method in ("GET", "POST", "HEAD")]

Splunk SPL Query

index=proxy OR index=traefik
| eval host_header=coalesce(http_host, cs_host, host_header)
| where match(host_header, "^[a-zA-Z0-9.-]+:(?!\\d+$)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host_header, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,traefik,cve-2026-88877,">
  <rule id="20268877" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.host">\.\:</field>
    <description>CVE-2026-88877: Traefik ingress-nginx auth bypass via malformed Host port</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,authentication_bypass,</group>
  </rule>
  <rule id="20268878" level="12">
    <decoded_as>json</decoded_as>
    <regex field="http.host">^[a-zA-Z0-9.-]+:(?!\d+$).*</regex>
    <description>CVE-2026-88877: Traefik sibling router bypass via non-numeric port</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Upgrade to Traefik v3.7.12, which contains the official fix. This is the only complete remediation.
   • If immediate upgrade is not possible, remove the nginx.ingress.kubernetes.io/from-to-www-redirect annotation from any Ingress that also carries an authentication annotation, or vice versa. This eliminates the sibling router creation that enables the bypass.
   • Audit all Ingress resources for the combined annotation pattern and prioritize those fronting sensitive backends.
   • As a defense-in-depth measure, enforce authentication at the backend service itself rather than relying solely on Traefik middleware.

2. Patch/upgrade steps:

   • Review the official Traefik release notes for v3.7.12 and confirm the fix addresses the sibling router middleware application.
   • Roll out the upgrade across all Traefik instances, including those in staging and production, and verify the version via the Traefik dashboard or /api/version endpoint if available.
   • After upgrade, re-test the combined annotation configuration with malformed Host headers to confirm the bypass is closed.

3. Long-term hardening:

   • Minimize reliance on a single edge layer for authentication and authorization; enforce backend-level auth controls.
   • Implement strict Host header validation at the load balancer or ingress layer to reject non-numeric or empty ports.
   • Continuously monitor for Traefik security advisories and subscribe to vendor release channels.
   • Adopt infrastructure-as-code scanning to flag risky annotation combinations in Kubernetes manifests.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88877
• Traefik Security Advisories: https://github.com/traefik/traefik/security/advisories
• Traefik Release Notes v3.7.12: https://github.com/traefik/traefik/releases
• CWE-639: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-88877. CISA KEV status is NO, EPSS is not yet scored, and no public PoC or Nuclei template exists as of this report.