CVE-2026-40912 in Traefik
Summary
by MITRE • 05/01/2026
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does not match the protected path patterns and therefore allows the request through. The backend then normalizes the dot-segment to the real path per RFC 3986 and serves the protected content An unauthenticated attacker can exploit this against any backend that performs dot-segment normalization. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/02/2026
The vulnerability in Traefik represents a critical authentication bypass flaw that emerged from the improper handling of URL path normalization within the StripPrefixRegex middleware. This issue affects versions prior to 2.11.43, 3.6.14, and 3.7.0-rc.2, creating a significant security risk for organizations relying on Traefik's reverse proxy capabilities. The flaw specifically manifests when StripPrefixRegex is combined with authentication mechanisms such as ForwardAuth, BasicAuth, or DigestAuth, creating a pathway for unauthorized access to protected resources.
The technical root cause stems from a fundamental mismatch in how URL path components are processed within the middleware. The system correctly matches the regular expression against the decoded URL path to determine which portion to strip, but subsequently employs the byte length of this matched result to slice the original percent-encoded raw path. This approach becomes problematic when the prefix portion contains dot characters, as the slicing operation produces dot-segment sequences in the raw path. These dot-segment sequences, such as /./admin/secret, represent valid URL encoding patterns that maintain their structural integrity through the proxy layer while appearing to bypass authentication checks.
When ForwardAuth receives requests containing these dot-segment paths in the X-Forwarded-Uri header, the authentication system fails to match these paths against the intended protected resource patterns. The authentication middleware operates on the normalized path that includes these dot segments, which do not align with the expected path patterns configured for access control. This misalignment allows unauthorized requests to proceed through the authentication layer, while the backend system processes these requests through its own URL normalization according to RFC 3986 standards. The backend's path normalization converts the dot-segment notation back to the actual intended path, thereby granting access to protected content that should have required authentication.
The operational impact of this vulnerability extends beyond simple access control bypass, representing a sophisticated attack vector that leverages HTTP protocol normalization behaviors. This vulnerability specifically targets environments where Traefik serves as a reverse proxy for applications with authentication mechanisms, making it particularly dangerous for web applications that rely on path-based access controls. The attack requires minimal privileges and can be executed against any backend system that performs dot-segment normalization, making it applicable across diverse deployment scenarios including web applications, API gateways, and microservices architectures. The vulnerability's classification aligns with CWE-285 (Improper Authorization) and follows ATT&CK technique T1078 (Valid Accounts) by enabling unauthorized access through legitimate authentication bypass mechanisms.
Organizations must implement immediate mitigation strategies including upgrading to patched versions 2.11.43, 3.6.14, or 3.7.0-rc.2, which address the core path normalization issue in the StripPrefixRegex middleware. Additionally, administrators should consider implementing additional security controls such as path-based access control validation, request header monitoring, and comprehensive logging of authentication bypass attempts. The vulnerability demonstrates the importance of proper URL handling in proxy systems and highlights the need for careful consideration of protocol normalization behaviors in security-critical components. Security teams should also conduct thorough audits of their Traefik configurations to identify instances where the vulnerable middleware combinations are in use, particularly in environments with complex authentication and authorization schemes that depend on path-based access controls.