Go/github.com/traefik/traefik CVE-2026-88011, CVE-2026-88879: high 8.1, EPSS 0.42%

Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6455
• nvd: CVE-2026-88011
• https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c
• https://github.com/traefik/traefik/commit/0331801c72329e0eaeb850e53ccce87c57fbecf8
• https://github.com/traefik/traefik/pull/13720
• https://github.com/traefik/traefik/releases/tag/v2.11.56
• https://github.com/traefik/traefik/releases/tag/v3.7.12

CVE-2026-88011, CVE-2026-88879 · published 2026-09-16T16:56:22Z · modified 2026-09-17T17:40:34.771461848Z · JSON