Traefik EUVD-2026-75545

The backend server behind Traefik must support the deprecated h2c upgrade mechanism as defined in RFC 7540 Section 3.2 and respond with HTTP 101 Switching Protocols when presented with Upgrade: h2c-this is the primary limiting condition and is not the default for most HTTP/1.1 backends or for gRPC services configured via Traefik's h2c:// scheme (which uses prior-knowledge HTTP/2, not the upgrade path). Affected Traefik versions are 2.11.26 through 2.11.56 and 3.4.2 through 3.7.12; versions outside these ranges are unaffected. No authentication, elevated privileges, special Traefik configuration, or non-default client-side setup is required-any network-reachable client can send the crafted upgrade headers. The attack is bounded by the requirement that the specific backend being targeted must itself accept h2c upgrade responses, which narrows the realistic attack surface to deployments that include h2c-capable backend services (e.g., certain gRPC servers, or backends explicitly configured to accept h2c).

The CVSS 4.0 score of 7.0 is calibrated primarily by AT:P-the attack requires that the targeted backend actively support and accept the deprecated h2c upgrade mechanism, which is not a default behavior for most HTTP/1.1 backends or for gRPC services configured with Traefik's h2c:// scheme. Backends serving HTTP/2 via prior knowledge only, or HTTP/1.1-only backends, are entirely unaffected regardless of Traefik version. Where the condition is met, however, the impact is severe: SC:H/SI:H signals that the entire subsequent-system (backend) security posture collapses-every authentication, authorization, and IP-restriction control configured in Traefik becomes a silent no-op for the duration of the tunneled connection. Even a mid-sized municipal IT team in legnica running Kubernetes clusters with h2c-enabled gRPC microservices behind Traefik should treat this as urgent patching work, since ForwardAuth-protected administrative APIs become fully reachable from any network client that can reach the ingress. No EPSS score was supplied in the input data; the vulnerability is not listed in CISA KEV; and no public exploit code has been identified, suggesting exploitation is not currently opportunistic or widespread. Nonetheless, the PR:N/UI:N nature means any network client can attempt the upgrade without prior compromise.

An unauthenticated attacker sends an HTTP/1.1 request to a Traefik ingress endpoint with headers Connection: Upgrade, Upgrade: h2c, and HTTP2-Settings: AAMAAABk… targeting a backend gRPC service that accepts h2c upgrades. The backend returns 101 Switching Protocols; Traefik enters tunnel mode and stops evaluating its ForwardAuth and IPAllowList middleware for that connection. The attacker then issues HTTP/2 requests over the same connection, reaching internally-protected administrative API paths without supplying any credentials or originating from an allowed IP address.