onyx --cves cve-2026-88011
CVE-2026-88011
- score
- 0.3
- cvss
- 8.1
- epss
- 0.4%
- published
- 2026-09-10
- kev added
- —
- first seen
Traefik < 2.11.56 and 3.0.0 to < 3.7.12 contains an identity spoofing vulnerability caused by client-supplied dot-form headers surviving ForwardAuth replacement and underscoreHeadersStrategy, letting attackers spoof identity headers, exploit requires backend normalization of headers.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8
- https://github.com/traefik/traefik/pull/13720
- https://github.com/traefik/traefik/releases/tag/v2.11.56
- https://github.com/traefik/traefik/releases/tag/v3.7.12
- https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c