CVE-2026-88008 in Traefik: h2c tunnel bypasses middleware and BasicAuth

Traefik is affected by CVE-2026-88008 (CVSS 7.0): when a backend replies 101 Switching Protocols to an Upgrade: h2c request, the connection becomes a raw tunnel and subsequent HTTP/2 requests skip Traefik's routers and middleware. An unauthenticated attacker can reach a BasicAuth-protected path via a public one. Fixed in 2.11.57 and 3.7.13.

• Affected: Traefik 2.11.26–2.11.56 and 3.4.2–3.7.12; fixed in 2.11.57 and 3.7.13
• CVSS 7.0 under v4.0, with some advisories citing 9.1 under CVSS 3.1
• Exploit needs a shared backend for public and protected routers and a 101 response to Upgrade: h2c
• Once the tunnel opens, middleware and BasicAuth are never applied to HTTP/2 requests