CVE-2026-88007: Connection Hijacking and Unauthorized Session Reuse in Traefik HTTP/3 Proxying

CVE-2026-88007 represents a critical security flaw in the Traefik reverse proxy and load balancer. The vulnerability lies within Traefik's implementation of HTTP/3 proxying and its connection management when interfacing with backends that require connection-bound authentication, such as NTLM or Negotiate (Kerberos). Under specific conditions, an unauthenticated client can hijack and reuse an authenticated session of another legitimate user.

Connection-bound authentication mechanisms bind a user's authenticated session directly to the physical transport layer socket (TCP) established between the reverse proxy and the backend server. To maintain isolation between different clients, a reverse proxy must ensure that distinct client connections do not share the same backend connection context. When this isolation is compromised, the security boundary between users collapses.

In Traefik, this boundary was maintained correctly for HTTP/1.1 and HTTP/2 clients, but a protocol-parity gap occurred in HTTP/3. Because HTTP/3 utilizes QUIC (UDP) instead of TCP on the frontend, the connection initialization path is handled differently. This difference led to an omission in context initialization, resulting in authenticated backend TCP connections being returned to a globally shared transport pool rather than being locked to a specific client.

The technical root cause of the vulnerability resides in the lack of connection-scoped transport initialization within Traefik's HTTP/3 server entrypoint setup. Normally, when Traefik forwards requests to backends utilizing connection-bound authentication, it employs a stickyRoundTripper. For HTTP/1.1 and HTTP/2, this mechanism is instantiated via service.AddTransportOnContext(ctx), which allocates an empty connection-scoped transport holder within the request context.

When a backend challenges a request with a WWW-Authenticate: NTLM or Negotiate header, the proxy's kerberosRoundTripper intercepts the response. It creates a dedicated, cloned RoundTripper instance for that client and stores its reference in the allocated context-bound holder. Subsequent requests from the same client reuse this dedicated RoundTripper, ensuring all communication goes through the same backend TCP connection, isolated from other clients.

However, in pkg/server/server_entrypoint_tcp_http3.go, the ConnContext generator for HTTP/3 failed to call service.AddTransportOnContext(ctx). As a result, the request context lacked the necessary placeholder. When the kerberosRoundTripper completed the authentication handshake, it had no location to cache the dedicated RoundTripper, causing the authenticated backend TCP connection to be returned to the globally shared backend pool instead of being bound to the client.

Furthermore, the logic used to determine whether connection-bound authentication was being utilized had a validation weakness. The proxy analyzed the WWW-Authenticate header using a case-sensitive prefix match (strings.HasPrefix). Because RFC 9110 dictates that authentication schemes are case-insensitive, backends responding with lower-case schemes (such as ntlm or negotiate) bypassed the isolation logic entirely, reverting to the shared pool.

To understand the vulnerability, analyze the original implementation of the ConnContext function in pkg/server/server_entrypoint_tcp_http3.go and compare it to the corrected patch. The original code only configured TLS options name in the context, neglecting the required initialization of the connection transport holder.

// BEFORE PATCH
ConnContext: func(ctx context.Context, c *quic.Conn) context.Context {
    tlsOptionsName, err := h3.getTLSOptionsName(c)
    if err != nil {
        log.WithoutContext().Errorf("Error getting TLS options name for client: %v", err)
        return ctx
    }
    return tcp.AddTLSOptionsNameInContext(ctx, tlsOptionsName)
},

// AFTER PATCH
ConnContext: func(ctx context.Context, c *quic.Conn) context.Context {
    // This adds an empty struct in order to store a RoundTripper in the ConnContext in case of Kerberos or NTLM.
    ctx = service.AddTransportOnContext(ctx)
 
    tlsOptionsName, err := h3.getTLSOptionsName(c)
    if err != nil {
        log.WithoutContext().Errorf("Error getting TLS options name for client: %v", err)
        return ctx
    }
 
    return tcp.AddTLSOptionsNameInContext(ctx, tlsOptionsName)
},

The secondary fix corrected the header-matching logic inside pkg/server/service/roundtripper.go. The case-sensitive prefix search was replaced with a parsing step that strips parameters and evaluates the scheme in a case-insensitive manner using strings.EqualFold.

// BEFORE PATCH
func containsNTLMorNegotiate(h []string) bool {
    return slices.ContainsFunc(h, func(s string) bool {
        return strings.HasPrefix(s, "NTLM") || strings.HasPrefix(s, "Negotiate")
    })
}
 
// AFTER PATCH
func containsNTLMorNegotiate(h []string) bool {
    return slices.ContainsFunc(h, func(s string) bool {
        // RFC 9110 section 11.1 defines the auth-scheme as case-insensitive,
        // hence a challenge is matched on its scheme token whatever its case.
        scheme, _, _ := strings.Cut(s, " ")
        return strings.EqualFold(scheme, "NTLM") || strings.EqualFold(scheme, "Negotiate")
    })
}

This two-pronged fix is comprehensive because it addresses both the initialization failure that completely broke the isolation for HTTP/3 and the parsing weaknesses that could allow variant bypasses. By mapping the authentication context explicitly to the QUIC-level connection context and properly parsing headers in compliance with RFC 9110, the patch successfully stops session-bound leakage.

Exploitation of CVE-2026-88007 does not require sophisticated tools or credentials. It relies on the presence of a victim establishing an authenticated session over HTTP/3. The primary prerequisite is that the Traefik entrypoint must support HTTP/3, keep-alives must be enabled on backend TCP connections, and the backend application must utilize connection-bound authentication like NTLM or Negotiate.

An attacker begins by establishing their own HTTP/3 session to the same Traefik instance. The attacker does not need to submit valid credentials; they simply wait for or actively trigger connections. When a legitimate user (the victim) logs in, their credentials are authenticated, and their backend connection is erroneously placed in the globally shared pool due to the context initialization omission.

When the attacker sends a request to the backend through Traefik, the load balancer retrieves an active connection from the shared backend pool. Due to the lack of client isolation, Traefik may select the active backend connection previously authenticated by the victim. The backend executes the attacker's request within the context of the victim's session, resulting in a successful security bypass.

The severity of CVE-2026-88007 is classified as critical, receiving a CVSS v4.0 score of 9.1. The primary impacts are high-severity compromises of both confidentiality and integrity. Because the proxy acts on behalf of the client, an attacker hijacking the session inherits the exact authorization scope of the victim user, which can include administrative control, access to restricted personnel data, or the ability to execute transactions.

The vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N indicates that the attack vector is network-based and does not require complex execution, but does require specific environmental conditions (the 'AT:P' parameter, representing the prerequisite of having an active HTTP/3 connection-bound backend). No special privileges or user interaction are required to exploit the bug.

While this vulnerability has not been observed in active ransomware campaigns or cataloged in the CISA KEV at the time of publication, the potential impact on enterprise environments using Traefik in front of legacy Active Directory, Exchange, or IIS environments is severe. The lack of auditing capability makes this issue particularly dangerous, as the backend server logs the activity as belonging to the legitimate victim, leaving no simple trail pointing to the attacker.

Remediation requires upgrading Traefik to the patched releases. For deployments using the v2 branch, you must upgrade to at least version 2.11.57. For deployments on the v3 branch, you must upgrade to at least version 3.7.13. These updates are drop-in replacements and do not alter other routing behaviors.

If upgrading is not immediately possible, you must implement temporary mitigations to secure your environment. The most effective workaround is to disable HTTP/3 on any entrypoints leading to backends that utilize connection-bound authentication. By removing the http3: {} block from your configuration, Traefik will fall back to HTTP/1.1 or HTTP/2, where the context isolation mechanisms function correctly.

Alternatively, you can disable backend connection keep-alives by setting disableKeepAlives: true in your ServersTransport settings. While this prevents the reuse of authenticated connections, it will introduce latency as a new TCP connection must be established for every request. Lastly, transitioning backends from legacy NTLM/Negotiate to modern authentication protocols (OIDC, OAuth 2.0) is strongly recommended to eliminate transport-bound vulnerabilities entirely.