CVE-2026-88008-PoC

CVE-2026-88008 General Python #poc #github #cve-2026-88008 #general

Author

Boreas37

Published

2026-09-27

Stars

0

Forks

0

Repository

Boreas37/CVE-2026-88008-PoC

Description

CVE-2026-88008 - Traefik (=2.11.56 / =3.7.12): a client-controlled h2c upgrade tunnels past routers and middleware (BasicAuth/ForwardAuth/IPAllowList), unauthorised access + no access logging. Stdlib-only Python PoC + real Jetty h2c lab, verified on v3.7.12 vs v3.7.13.

View on GitHub More PoCs for CVE-2026-88008

CVE-CVE-2026-88008 Details

Severity

CRITICAL

CVSS Score

9.1

CWE

CWE-444

Description

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated...

View on NVD

Related PoCs for CVE-2026-88008

No other PoCs found for this CVE.