Path Traversal in Traefik StripPrefix Middleware

Executive Summary

CVE-2026-48020 is a high-severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization.

The issue arises when a public router uses a PathPrefix rule combined with the StripPrefix middleware. If a request path contains ".." or its percent-encoded form "%2e%2e", the request initially matches the public route during routing. However, after the prefix is stripped and the path is normalized, the request resolves to a path served by a separate, authenticated router.

This means an attacker can access protected backend paths such as admin or internal configuration endpoints without passing the authentication middleware intended to protect those routes.

The root cause is the path normalization process after prefix stripping, which modifies the request path in a way that bypasses intended routing rules.

This vulnerability affects Traefik versions up to v2.11.46, v3.6.17, and v3.7.1 and has been fixed in versions v2.11.48, v3.6.19, and v3.7.3.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unauthenticated attacker to bypass authentication and authorization controls on protected routes.

As a result, attackers can access sensitive backend paths such as admin interfaces, internal configuration endpoints, secrets, or management functionality that should be protected.

In some cases, if the backend exposes execution primitives, this unauthorized access could lead to conditional remote code execution.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing if requests containing ".." or its percent-encoded form "%2e%2e" in the path can bypass route-level authentication and authorization in Traefik's StripPrefix middleware.

Specifically, you can attempt to send HTTP requests to public routes that use PathPrefix rules with StripPrefix middleware, including paths like /api/.. or /api/%2e%2e, and observe if you can access protected backend paths such as /admin or /internal/config without authentication.

Example curl command to test this might be:

• curl -i http://your-traefik-host/api/../admin
• curl -i http://your-traefik-host/api/%2e%2e/admin

If these requests return responses from protected endpoints without authentication, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Traefik to a fixed version: v2.11.48, v3.6.19, or v3.7.3, where this vulnerability has been patched.

If upgrading immediately is not possible, you should apply stricter routing rules to avoid the bypass. Specifically, use stricter prefix boundaries such as PathRegexp(`^/api(/|$)`) or PathPrefix(`/api/`) combined with StripPrefix(`/api/`) middleware to prevent path normalization from allowing unauthorized access.

Additionally, review and audit your routing and middleware configurations to ensure that no public routes can be manipulated to access protected backend paths.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Traefik's StripPrefix middleware allows unauthenticated attackers to bypass route-level authentication and authorization, potentially accessing protected backend paths such as admin or internal configuration endpoints.

This unauthorized access to protected resources could lead to exposure of sensitive data or management functionality, which may impact compliance with standards and regulations like GDPR or HIPAA that require strict access controls and protection of sensitive information.

If exploited, the vulnerability could result in unauthorized data access or modification, thereby violating requirements for data confidentiality and integrity mandated by such regulations.

Useful 0 Not Useful 0