CVE-2026-65600
Received Received - Intake

Authentication Bypass via Path Traversal in Traefik

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulnCheck

Description
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-65600
EUVD
EUVD-2026-47644

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
traefik traefik to 3.7.6 (inc)
traefik traefik From 3.7.0 (inc) to 3.7.6 (inc)
traefik traefik 2.11.52
traefik traefik 3.6.23
traefik traefik 3.7.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Traefik's ReplacePathRegex middleware affecting versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6. It occurs when the middleware uses a regex that captures user-controlled path segments without requiring a mandatory path separator. An attacker can send a crafted request like GET /api../admin which produces an un-normalized path such as /../admin. If the backend normalizes this path, it may resolve to a protected route, bypassing authentication.

Detection Guidance
  • Check Traefik version with: traefik version. If version is <= v2.11.51, >= v3.6.0 <= v3.6.22, or >= v3.7.0 <= v3.7.6, it is vulnerable.
  • Inspect Traefik configuration for ReplacePathRegex middleware with regex patterns like ^/api(.*) without mandatory path separators.
  • Test for path traversal by sending crafted requests like GET /api../admin and observe if backend resolves to protected routes.
Impact Analysis

This vulnerability allows unauthenticated remote attackers to bypass authentication middleware and access protected routes or resources. If your Traefik instance uses ReplacePathRegex with a vulnerable regex configuration, attackers could exploit this to gain unauthorized access to sensitive data or administrative functions. The impact includes potential data breaches, unauthorized system access, and compromise of confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. GDPR requires protection of personal data and may impose fines for breaches. HIPAA requires safeguards for protected health information. Exploitation of this flaw could result in non-compliance, legal penalties, and reputational damage due to data exposure.

Mitigation Strategies
  • Upgrade Traefik to patched versions: v2.11.52, v3.6.23, or v3.7.7 or later.
  • Review and update ReplacePathRegex middleware configurations to include mandatory path separators in regex patterns.
  • Implement additional access controls at the backend to validate paths even after normalization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart