CVE-2026-88877

Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.

• CWE-639

• https://github.com/traefik/traefik/security/advisories/GHSA-cjr6-pf59-jq29Patch, Vendor Advisory
• https://www.vulncheck.com/advisories/traefik-3.7.0-authentication-bypass-via-from-to-www-redirectThird Party Advisory

Published

Sep 10, 2026

Last Modified

Sep 14, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88871WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…4.3
• CVE-2026-88872AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…7.1
• CVE-2026-88873WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…7.1
• CVE-2026-88874AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…7.5
• CVE-2026-88875AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…4.3
• CVE-2026-88876AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…7.5
• CVE-2026-88878Traefik is an HTTP reverse proxy and load balancer. In versi…5.3
• CVE-2026-88879Traefik is an HTTP reverse proxy and load balancer. In Traef…8.2
• CVE-2026-8888Version 3.0.7 of the Securly Chrome Extension downloads conf…7.5
• CVE-2026-88880Renovate before 44.11.3 fails to validate Link header destin…8.6
• CVE-2026-88881Renovate, a dependency update tool, follows pagination links…8.6
• CVE-2026-88882Renovate is a dependency update automation tool. In versions…8.6