PT-2026-68796 · Traefik · Traefik
CVE-2026-71324
·
Published
2026-07-22
·
Updated
2026-09-04
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Traefik versions prior to 2.11.53
Traefik versions prior to 3.6.24
Traefik versions prior to 3.7.9
Description
Traefik's default HTTP reverse proxy forwards HTTP/2 or HTTP/3
CONNECT requests and their bodies to HTTP/1.1 upstreams using a shared net/http.Transport. If the upstream server responds to the CONNECT request with a keep-alive non-2xx response without draining the request body, Traefik returns the desynchronized backend socket to its shared connection pool. An unauthenticated attacker can exploit this to perform cross-user response poisoning, causing a different client to read a smuggled response that may contain private or authenticated content.Technical details include:
- Vulnerable Parameters or Variables: The
sanitizePathoption (defaulttrue) is not a reliable defense as some backends still allow exploitation. - Middleware: The ForwardAuth middleware is also affected when
forwardBodyis set totrueandpreserveRequestMethodis set totrue, as it can re-issue aCONNECTrequest with a buffered body, exposing the auth-client pool to desynchronization.
Recommendations
Update Traefik to version 2.11.53.
Update Traefik to version 3.6.24.
Update Traefik to version 3.7.9.
As a temporary mitigation, disable the ForwardAuth middleware or set
forwardBody and preserveRequestMethod to false to reduce the risk of auth-client pool poisoning.Exploit
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Traefik