Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-88009 · CVE overview and exploitation status

EUVD-2026-75578

GHSA-f52w-8j3h-j724

GO-2026-6465

cve-program · CVE-2026-88009

• https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724
• https://github.com/traefik/traefik/pull/13796
• https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

euvd · EUVD-2026-75578

• https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724
• https://github.com/traefik/traefik/pull/13796
• https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

nvd · CVE-2026-88009

• https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9
• https://github.com/traefik/traefik/pull/13796
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13
• https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724

osv · GHSA-f52w-8j3h-j724

• https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724
• https://nvd.nist.gov/vuln/detail/CVE-2026-88009
• https://github.com/traefik/traefik/pull/13796
• https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

osv · GO-2026-6465

• https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724
• https://nvd.nist.gov/vuln/detail/CVE-2026-88009
• https://github.com/traefik/traefik/commit/58d1e9ca204526823211e30fd4634101c59d58e9
• https://github.com/traefik/traefik/pull/13796
• https://github.com/traefik/traefik/releases/tag/v2.11.57
• https://github.com/traefik/traefik/releases/tag/v3.7.13

• Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluat… · Advisory content revised · 1 Nov 2026