CVE-2026-67309 in Traefik
Summary
by MITRE • 08/01/2026
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability represents a critical path traversal flaw in Traefik's Kubernetes Ingress controller implementation that enables unauthorized access to protected resources through carefully crafted requests. The vulnerability specifically affects versions between 3.7.0 and 3.7.7 where the RewriteTarget middleware processes regex patterns without proper validation of dot-segment sequences that could be exploited for path traversal attacks. The technical root cause lies in how the ingress controller handles regex capture groups from nginx.ingress.kubernetes.io/rewrite-target annotations, particularly when these patterns do not enforce path separator requirements. When an attacker crafts a request like /api../admin against an Ingress rule configured with a pattern such as /api(.*) and rewrite target /$1, the system incorrectly processes the dot-segment notation without normalization validation.
The operational impact of this vulnerability is severe as it allows attackers to bypass authentication mechanisms that are typically protected by separate router configurations. The flaw specifically targets scenarios where backend systems perform path normalization after request forwarding, creating a window where maliciously constructed paths can navigate to protected resources. This occurs because the ingress controller accepts the rewritten path without validating whether dot-segment sequences have been properly normalized before forwarding to the backend service. The vulnerability is particularly dangerous when combined with authentication mechanisms such as BasicAuth, DigestAuth, or ForwardAuth that are configured on separate routers protecting sensitive endpoints.
Security researchers have classified this issue as a path traversal vulnerability under CWE-22, which represents one of the most common and dangerous classes of web application vulnerabilities. The attack pattern aligns with techniques documented in MITRE ATT&CK framework under T1078 for valid accounts and T1566 for social engineering, though it specifically exploits configuration weaknesses in ingress controllers rather than traditional credential theft methods. The vulnerability demonstrates how seemingly innocuous regex processing can create security holes when combined with path normalization behaviors in backend systems, creating a complex attack surface that requires careful consideration of both front-end request handling and back-end resource access controls.
Organizations should immediately upgrade to Traefik version 3.7.8 or later to resolve this vulnerability, as the fix addresses the core issue by implementing proper validation of dot-segment sequences in rewritten paths before forwarding requests to backend services. Additional mitigations include reviewing all ingress controller configurations to ensure that regex patterns properly enforce path separator requirements and implementing network-level restrictions to limit access to sensitive endpoints. Security teams should also conduct comprehensive audits of their ingress controller configurations to identify any other potentially vulnerable rewrite rules, particularly those that use capture groups without proper validation mechanisms. The vulnerability serves as a reminder of the importance of validating all user-supplied data in request processing pipelines and the critical need for proper normalization of path sequences at multiple layers of the application architecture.