onyx --cves cve-2026-88007
CVE-2026-88007
- score
- 0.4
- cvss
- 9.1
- epss
- 0.6%
- published
- 2026-09-10
- kev added
- —
- first seen
Traefik 2.11.0 to 2.11.57 and 3.7.13 contain an authentication bypass caused by shared backend transport usage in HTTP/3 ConnContext, letting attackers reuse authenticated backend connections to impersonate victims, exploit requires HTTP/3 and connection-bound NTLM or Negotiate authentication enabled.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://github.com/traefik/traefik/pull/13812
- https://github.com/traefik/traefik/releases/tag/v2.11.57
- https://github.com/traefik/traefik/releases/tag/v3.7.13
- https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv
- https://github.com/traefik/traefik/commit/ff39c47d7459dec9cd8de63c1a4e7aa7315bdc1c