onyx --cves cve-2026-88877
CVE-2026-88877
- score
- 9.9
- cvss
- 9.8
- epss
- 0.6%
- published
- 2026-09-10
- kev added
- —
- first seen
Traefik v3.7.0 to v3.7.11 contains a broken access control vulnerability caused by mishandling of Kubernetes ingress-nginx annotations, letting attackers bypass authentication and other middlewares, exploit requires crafted Host header with non-numeric or empty port.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.