THREAT OPS › Threat News › [GHSA] GHSA-f52w-8j3h-j724 (high) — Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
[GHSA] GHSA-f52w-8j3h-j724 (high) — Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
GHSA-f52w-8j3h-j724 Severity: high CVE: CVE-2026-88009
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
## Summary
Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form (for example `GET http:http://internal-vhost/admin HTTP/1.1`). Go parses this into `URL.Opaque`
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- d5072ce7b8765c9574246072e05dd81d84950da7sha1
- CVE-2026-88009cve
- CVE-2026-27587cve
- CVE-2026-27588cve
- CVE-2021-32779cve
- CVE-2021-29492cve
- CVE-2019-9901cve
- CVE-2023-27491cve
- CVE-2021-39156cve
- CVE-2023-25725cve
- http://internal-vhost/adminurl
- http://internal-vhost/admin`url
- http://internal-vhost/admin%2f..%2fsecreturl
- http://poc-nginx:80url
- https://doc.traefik.io/traefik/security/request-path/url
Original source: https://github.com/advisories/GHSA-f52w-8j3h-j724