Every CVE Search/ Get API key

CVE-2026-88007

Traefik HTTP/3 Backend NTLM Connection Reuse

9.1 CriticalFix available

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.60%Up 0.2 points since Sep 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Traefik HTTP/3 Backend NTLM Connection Reuse

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Record
CVE-2026-88007
CVSS 4.0
9.1 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-287, CWE-863
Updated
2026-11-02
EUVDEUVD-2026-75544 9.1

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Record
EUVD-2026-75544
CVSS 4.0
9.1 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-qqjf-53cj-pwvv 9.1

Traefik HTTP/3 Backend NTLM Connection Reuse

Summary

Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate (Kerberos) authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend round-tripper, but its ConnContext never called service.AddTransportOnContext, so kerberosRoundTripper fell back to the shared backend transport instead of a per-frontend-connection pool. On a route served over HTTP/3 to a backend that binds identity to a persistent connection via NTLM or Negotiate, an unrelated HTTP/3 client could be assigned a backend connection already authenticated as a victim and inherit that identity, reading victim-only data and performing actions as the victim without presenting the victim's credentials. Affected deployments require HTTP/3 enabled on the entrypoint, a backend using connection-bound NTLM/Negotiate authentication, and backend keep-alive; deployments using ordinary per-request authentication are not affected.

Patches

For more information

If you have any questions or comments about this advisory, please open an issue.

<details> <summary>Original Description</summary>

Traefik HTTP/3 Backend NTLM Connection Reuse

Summary

Traefik's HTTP/3 request path does not initialize the connection-scoped backend transport state that Traefik uses to isolate connection-bound NTLM and Negotiate authentication for HTTP/1.1 and HTTP/2. When a backend keeps authenticated identity on a persistent HTTP/1.1 TCP connection, an unrelated HTTP/3 client can reuse a victim-authenticated backend connection and inherit that backend identity.

In the attached reproduction, the HTTPS/HTTP/1.1 control case behaves correctly and isolates the attacker, but the HTTP/3 case allows a second unauthenticated client to read victim-only data and execute a state-changing request as actor=victim.

Validated target:

  • Repository: traefik/traefik
  • Commit: f2d0794417e4d06343e6e7c4722143f5b34bee45
  • Validation time: 2026-08-25T06:48:02Z
  • Commit time: 2026-08-24T08:26:06Z
  • Patched status: not evaluated

Details

The issue is caused by a protocol-parity gap between the normal TCP HTTP entrypoint path and the HTTP/3 entrypoint path.

For HTTP/1.1 and HTTP/2, Traefik explicitly creates a connection-scoped holder that can later store a dedicated RoundTripper for NTLM or Negotiate:

// pkg/server/server_entrypoint_tcp.go:691-703
var connContext multipleConnContext
connContext.AddConnContextFunc(func(ctx context.Context, c net.Conn) context.Context {
	// This adds an empty struct in order to store a RoundTripper in the ConnContext in case of Kerberos or NTLM.
	ctx = service.AddTransportOnContext(ctx)

	if tlsConn, ok := c.(*tls.Conn); ok {
		if tlsConnWithOptionsName, ok := tlsConn.NetConn().(tcp.TLSConn); ok {
			return tcp.AddTLSOptionsNameInContext(ctx, tlsConnWithOptionsName.TLSOptionsName)
		}
	}

	return ctx
})

That helper installs the per-connection holder, and kerberosRoundTripper depends on it. If the holder is absent, it falls back to the shared original backend transport. If NTLM or Negotiate is detected, it stores a dedicated cloned RoundTripper into that holder so future requests stay on the authenticated backend connection:

// pkg/server/service/transport.go:374-402
func AddTransportOnContext(ctx context.Context) context.Context {
	return context.WithValue(ctx, transportKey, &stickyRoundTripper{})
}

type kerberosRoundTripper struct {
	new                  func() http.RoundTripper
	OriginalRoundTripper http.RoundTripper
}

func (k *kerberosRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
	value, ok := request.Context().Value(transportKey).(*stickyRoundTripper)
	if !ok {
		return…
Record
GHSA-qqjf-53cj-pwvv
CVSS 4.0
9.1 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-287, CWE-863
Updated
2026-11-02
NVD 9.1

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Record
CVE-2026-88007
CVSS 4.0
9.1 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-287, CWE-863
Updated
2026-11-02
OSV 9.1

Traefik HTTP/3 Backend NTLM Connection Reuse

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Record
CVE-2026-88007
CVSS 4.0
9.1 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-287, CWE-863
Updated
2026-11-02
OSVGHSA-qqjf-53cj-pwvv 9.1

Traefik HTTP/3 Backend NTLM Connection Reuse

Summary

Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate (Kerberos) authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend round-tripper, but its ConnContext never called service.AddTransportOnContext, so kerberosRoundTripper fell back to the shared backend transport instead of a per-frontend-connection pool. On a route served over HTTP/3 to a backend that binds identity to a persistent connection via NTLM or Negotiate, an unrelated HTTP/3 client could be assigned a backend connection already authenticated as a victim and inherit that identity, reading victim-only data and performing actions as the victim without presenting the victim's credentials. Affected deployments require HTTP/3 enabled on the entrypoint, a backend using connection-bound NTLM/Negotiate authentication, and backend keep-alive; deployments using ordinary per-request authentication are not affected.

Patches

For more information

If you have any questions or comments about this advisory, please open an issue.

<details> <summary>Original Description</summary>

Traefik HTTP/3 Backend NTLM Connection Reuse

Summary

Traefik's HTTP/3 request path does not initialize the connection-scoped backend transport state that Traefik uses to isolate connection-bound NTLM and Negotiate authentication for HTTP/1.1 and HTTP/2. When a backend keeps authenticated identity on a persistent HTTP/1.1 TCP connection, an unrelated HTTP/3 client can reuse a victim-authenticated backend connection and inherit that backend identity.

In the attached reproduction, the HTTPS/HTTP/1.1 control case behaves correctly and isolates the attacker, but the HTTP/3 case allows a second unauthenticated client to read victim-only data and execute a state-changing request as actor=victim.

Validated target:

  • Repository: traefik/traefik
  • Commit: f2d0794417e4d06343e6e7c4722143f5b34bee45
  • Validation time: 2026-08-25T06:48:02Z
  • Commit time: 2026-08-24T08:26:06Z
  • Patched status: not evaluated

Details

The issue is caused by a protocol-parity gap between the normal TCP HTTP entrypoint path and the HTTP/3 entrypoint path.

For HTTP/1.1 and HTTP/2, Traefik explicitly creates a connection-scoped holder that can later store a dedicated RoundTripper for NTLM or Negotiate:

// pkg/server/server_entrypoint_tcp.go:691-703
var connContext multipleConnContext
connContext.AddConnContextFunc(func(ctx context.Context, c net.Conn) context.Context {
	// This adds an empty struct in order to store a RoundTripper in the ConnContext in case of Kerberos or NTLM.
	ctx = service.AddTransportOnContext(ctx)

	if tlsConn, ok := c.(*tls.Conn); ok {
		if tlsConnWithOptionsName, ok := tlsConn.NetConn().(tcp.TLSConn); ok {
			return tcp.AddTLSOptionsNameInContext(ctx, tlsConnWithOptionsName.TLSOptionsName)
		}
	}

	return ctx
})

That helper installs the per-connection holder, and kerberosRoundTripper depends on it. If the holder is absent, it falls back to the shared original backend transport. If NTLM or Negotiate is detected, it stores a dedicated cloned RoundTripper into that holder so future requests stay on the authenticated backend connection:

// pkg/server/service/transport.go:374-402
func AddTransportOnContext(ctx context.Context) context.Context {
	return context.WithValue(ctx, transportKey, &stickyRoundTripper{})
}

type kerberosRoundTripper struct {
	new                  func() http.RoundTripper
	OriginalRoundTripper http.RoundTripper
}

func (k *kerberosRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
	value, ok := request.Context().Value(transportKey).(*stickyRoundTripper)
	if !ok {
		return…
Record
GHSA-qqjf-53cj-pwvv
CVSS 4.0
9.1 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-287, CWE-863
Updated
2026-11-02
Show 5 moreShow less
OSVGO-2026-6466 No score

Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik

Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik

Record
GO-2026-6466
Updated
2026-11-02
OSVopenSUSE-SU-2026:12076-1 No score

traefik-3.7.13-1.1 on GA media

These are all security issues fixed in the traefik-3.7.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12076-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21897-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
openSUSE-SU-2026:21897-1
Updated
2026-11-02
OSVSUSE-SU-2026:23855-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23855-1
Updated
2026-11-02
OSVSUSE-SU-2026:23863-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23863-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/traefik/traefik/v3
Go
 3.0.0 up to 3.7.13
3.7.13
github.com/traefik/traefik/v2
Go
 2.11.0 up to 2.11.57
2.11.57
github.com/traefik/traefik
Go
 All versions None known
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
traefik
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 3.7.13-1.1
3.7.13-1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88007 is a critical vulnerability (CVSS 9.1) in Traefik, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in github.com/traefik/traefik/v3 3.7.13.

References

Show 97 moreShow less
This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open