CVE-2026-88008 – traefik

This traefik update fixes three authentication and authorization flaws in the reverse proxy. CVE-2026-88007 has a CVSS score of 9.1, Critical severity: with HTTP/3 enabled, an unrelated client can reuse a backend connection already authenticated through NTLM or Negotiate for a victim, then read the victim's data and act as that victim without the victim's credentials. CVE-2026-88008 has a CVSS score of 7.0, High severity: a client-supplied h2c upgrade request opens a raw tunnel to the backend, which skips routers, BasicAuth, ForwardAuth, IP allowlists, rate limits, logging, metrics, and tracing for every HTTP/2 request that follows.

CVE-2026-88877 has a CVSS score of 9.8, Critical severity: in the Kubernetes ingress-nginx provider, a crafted Host header with a non-numeric or empty port sends requests straight to protected backends with every annotation-derived middleware removed, including authentication and source-IP allowlisting. Versions 2.11.57, 3.7.12, and 3.7.13 fix these flaws, depending on the affected branch. Teams running traefik in front of authenticated services should upgrade now.