Go/github.com/traefik/traefik/v3 CVE-2026-88011, CVE-2026-88879: medium, EPSS 0.42%

Traefik: ForwardAuth identity spoofing via dot-form header alias

Action: Upgrade github.com/traefik/traefik/v3 to 3.7.12 or later.

go get github.com/traefik/traefik/v3@v3.7.12

Affected

Fixed versions

Sources

• osv: GHSA-rf44-j88r-hh8c#Go/github.com/traefik/traefik/v3
• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://nvd.nist.gov/vuln/detail/CVE-2026-88011
• https://github.com/traefik/traefik/pull/13720
• https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8
• https://github.com/traefik/traefik
• https://github.com/traefik/traefik/releases/tag/v2.11.56
• https://github.com/traefik/traefik/releases/tag/v3.7.12

CVE-2026-88011, CVE-2026-88879 · published 2026-09-10T20:28:15Z · modified 2026-09-17T17:40:34.771461848Z · JSON