Traefik entrypoint header-name sanitization bypassed via request trailers

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-88004 · CVE overview and exploitation status

EUVD-2026-75538

GHSA-v67p-phpq-fc8x

GO-2026-6467

cve-program · CVE-2026-88004

• https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x
• https://github.com/traefik/traefik/pull/13822
• https://github.com/traefik/traefik/commit/55bbda4f65e0f9c533c870983a767a7081126db7
• https://github.com/traefik/traefik/releases/tag/v3.7.13

euvd · EUVD-2026-75538

• https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x
• https://github.com/traefik/traefik/pull/13822
• https://github.com/traefik/traefik/commit/55bbda4f65e0f9c533c870983a767a7081126db7
• https://github.com/traefik/traefik/releases/tag/v3.7.13

nvd · CVE-2026-88004

• https://github.com/traefik/traefik/commit/55bbda4f65e0f9c533c870983a767a7081126db7
• https://github.com/traefik/traefik/pull/13822
• https://github.com/traefik/traefik/releases/tag/v3.7.13
• https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x

osv · GHSA-v67p-phpq-fc8x

• https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x
• https://nvd.nist.gov/vuln/detail/CVE-2026-88004
• https://github.com/traefik/traefik/pull/13822
• https://github.com/traefik/traefik/commit/55bbda4f65e0f9c533c870983a767a7081126db7
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v3.7.13

osv · GO-2026-6467

• https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x
• https://nvd.nist.gov/vuln/detail/CVE-2026-88004
• https://github.com/traefik/traefik/commit/55bbda4f65e0f9c533c870983a767a7081126db7
• https://github.com/traefik/traefik/pull/13822
• https://github.com/traefik/traefik/releases/tag/v3.7.13

• Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an u… · Advisory content revised · 1 Nov 2026