Traefik CVE-2026-88007

Exploitation requires all of the following to be true simultaneously: the target Traefik entrypoint must have HTTP/3 enabled; the backend service must use connection-bound authentication (NTLM or Negotiate/Kerberos, which the KerberosRoundTripper handles); and backend keep-alive must be active so the authenticated connection persists for reuse. The attacker is an unauthenticated remote client (PR:N/UI:N) but must contend with an attack requirement (CVSS 4.0 AT:P): they must get their request routed onto a backend connection that a victim has already authenticated, i.e. exploit the shared-transport window while a victim session is live. It does NOT affect HTTP/1.1 or HTTP/2 entrypoints, backends without connection-bound NTLM/Negotiate auth, or deployments with HTTP/3 disabled.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N, base 9.1) captures the shape well: network-reachable, no privileges, no user interaction, but AT:P reflects that a specific attack requirement (racing to inherit a victim's authenticated keep-alive backend connection) must be met. High confidentiality and integrity impact are justified because the attacker reads victim-only data and acts as the victim. However, exploitation is gated by a fairly narrow configuration: HTTP/3 must be enabled AND the backend must use connection-bound NTLM/Negotiate authentication AND backend keep-alive must be active. This makes the flaw serious where those conditions exist but not broadly exploitable across typical Traefik deployments, which more commonly proxy stateless HTTP backends. No EPSS score, KEV listing, or SSVC decision data was provided; there is no evidence of active exploitation, so this should be prioritized based on whether an environment actually runs the vulnerable HTTP/3 + connection-bound-auth combination rather than on the raw 9.1 alone.

An enterprise runs Traefik with an HTTP/3 entrypoint in front of an internal app that uses connection-bound NTLM authentication with keep-alive. A legitimate user authenticates and Traefik pins their session to a backend connection; an unrelated attacker then sends HTTP/3 requests through the same entrypoint and, because the backend transport is shared rather than per-frontend-connection, is routed onto the victim's already-authenticated backend connection, reading the victim's data and issuing requests as the victim. No public exploit is identified at time of analysis, though the vendor's fix PR includes a regression test that reproduces the sticky-connection crossover.