CVE-2026-65600 in Traefik
Summary
by MITRE • 07/22/2026
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Traefik's ReplacePathRegex middleware functionality where improper path normalization validation creates an authentication bypass opportunity. The flaw occurs when administrators configure regex patterns that capture user-controlled path segments without enforcing mandatory path separators, creating a condition where maliciously crafted requests can manipulate the path traversal behavior. The technical implementation allows attackers to exploit the lack of proper input sanitization by crafting requests that contain sequences like ../ which, when processed through the middleware, result in un-normalized paths being forwarded to backend services. This represents a classic path traversal vulnerability that operates at the application layer and can be classified under CWE-22 Path Traversal. The vulnerability specifically targets the normalization process within the middleware chain, where the system fails to validate that the transformed path maintains proper structural integrity before forwarding to downstream components.
The operational impact of this vulnerability extends beyond simple path manipulation as it directly undermines the security controls implemented by authentication middleware layers. When an attacker crafts a request such as GET /api../admin, the regex pattern "^/api(.*)" captures the ../ sequence and replaces it with "/$1", producing an un-normalized path that contains directory traversal elements. The backend service then processes this path through its own normalization routine, which resolves the ../ sequence to access protected administrative routes that should normally require authentication. This creates a scenario where authentication controls become ineffective because the middleware layer fails to validate the integrity of transformed paths before transmission. Attackers can leverage this bypass to gain unauthorized access to protected resources, potentially escalating privileges or accessing sensitive data depending on the backend service configuration.
The security implications align with several ATT&CK framework techniques including T1078 Valid Accounts and T1566 Phishing, as attackers can exploit this vulnerability to bypass authentication mechanisms without requiring legitimate credentials. The vulnerability's exploitation requires minimal reconnaissance since it relies on predictable path traversal patterns that can be easily tested against any Traefik deployment using the affected versions. System administrators must understand that this issue affects not just the specific middleware component but also demonstrates a broader architectural weakness in how path transformations are validated within the application security boundary. The fix implemented in versions v2.11.52, v3.6.23, and v3.7.7 addresses the core normalization validation by ensuring that transformed paths undergo proper sanitization before being forwarded to backend services, preventing the propagation of potentially malicious path sequences.
Organizations should treat this vulnerability as a critical security concern requiring immediate remediation across all Traefik deployments using affected versions. The mitigation strategy involves updating to the patched versions while also implementing additional defensive measures such as validating middleware configurations to prevent uncontrolled regex patterns from capturing user input without proper separator enforcement. Security teams should conduct comprehensive audits of all Traefik configurations to identify potentially vulnerable ReplacePathRegex rules and ensure that path normalization validation is consistently applied across all middleware components. The vulnerability serves as a reminder of the importance of input validation at multiple layers within application security architectures, particularly when dealing with path manipulation functions that can be exploited to bypass authentication controls through seemingly benign configuration parameters.