CVE-2026-88009

Traefik , an open-source HTTP reverse proxy and load balancer, is affected by a request-target handling flaw prior to 2.11.57 and 3.7.13 . A rootless HTTP/1 request target is stored by Go in URL.Opaque while URL.Path remains empty. The rewriteRequestBuilder evaluates routing, path sanitization, f...

CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sanitization, forwardAuth,...