Listen to this Post
CVE-2026-65600 is an authentication bypass vulnerability affecting Traefik, a popular cloud-native application proxy. The flaw resides in the ReplacePathRegex middleware, which is used to rewrite request paths based on regular expression patterns before forwarding them to backend services. When this middleware is configured with a regex that captures user‑controlled path segments without enforcing a mandatory path separator—for example, the pattern `^/api(.)` with replacement /$1—the middleware performs the substitution but does not validate that the resulting path matches its normalized canonical form. This oversight allows an unauthenticated remote attacker to craft a request containing path traversal sequences that, after substitution, produce an un‑normalized path such as /../admin. Traefik forwards this raw path to the backend without any sanitization or normalization. The backend, however, typically normalises the path (e.g., resolving `/../admin` to /admin) and serves the protected resource, thereby bypassing any authentication middleware (BasicAuth, ForwardAuth, DigestAuth, etc.) that was guarding that route. The vulnerability is exploitable via simple HTTP GET requests, but also affects POST, PUT, DELETE, and other methods. URL‑encoded variants (e.g., `%2e%2e` for ..) work equally well, increasing the attack surface. The root cause is similar to a previously patched issue in the StripPrefix middleware (CVE‑2026‑48020), but the fix was not consistently applied to ReplacePathRegex. Affected versions include all Traefik v2.x up to v2.11.51, v3.6.x from v3.6.0 through v3.6.22, and v3.7.x from v3.7.0 through v3.7.6. The vulnerability has a CVSS 4.0 score of 7.8 (High) with a network‑based attack vector, low attack complexity, no privileges required, and no user interaction. It has high confidentiality and integrity impact on downstream systems. The issue was patched in versions v2.11.52, v3.6.23, and v3.7.7. Administrators are urged to upgrade immediately or to audit their ReplacePathRegex configurations and modify any regex that lacks a mandatory slash before the capture group (e.g., change `^/api(.)` to ^/api/(.)), which effectively neutralises the traversal vector.
DailyCVE Form:
Platform: Traefik
Version: <=v2.11.51, v3.6.0‑v3.6.22, v3.7.0‑v3.7.6
Vulnerability: Authentication Bypass via Path Traversal
Severity: High (CVSS 7.8)
date: 2026‑07‑22
Prediction: 2026‑07‑22
Analytics under heading What Undercode Say:
Check Traefik version ./traefik version Test for vulnerability (replace <traefik-host> with actual target) curl -v "http://<traefik-host>/api../admin" URL-encoded variant curl -v "http://<traefik-host>/api%2e%2e/admin" If protected endpoint returns 200 OK, the bypass is successful Example output indicating unprotected access: HTTP/1.1 200 OK ... List all ReplacePathRegex middleware configurations (assuming Traefik dynamic config in YAML) grep -r "ReplacePathRegex" /etc/traefik/ Check for dangerous patterns (missing mandatory slash) grep -E "regex:\s\"\^/[^/]+(.\)\""
Exploit:
An attacker sends a crafted GET request to a Traefik‑exposed route where ReplacePathRegex is configured with a vulnerable regex (e.g., `^/api(.)` → /$1). By inserting `../` after the matched prefix—for instance, GET /api../admin—the middleware produces the substituted path /../admin. Traefik forwards this un‑normalized path to the backend. The backend server normalises the path to `/admin` and processes the request as if it were intended for that protected resource. Because the authentication middleware is attached to the original router (which expects the normalised path), the bypass is complete. No credentials are required, and both read and write operations are possible.
Protection:
- Upgrade to a patched version: v2.11.52, v3.6.23, v3.7.7, or later.
- If an immediate upgrade is not feasible, audit all ReplacePathRegex middleware definitions and modify any regex pattern that captures user‑controlled segments without a mandatory path separator. For example, change `^/api(.)` to `^/api/(.)` to force a slash before the capture group.
- Apply input validation at the backend level to reject requests containing `..` or encoded traversal sequences.
- Use Traefik’s `PathPrefix` matcher with strict prefixes instead of relying solely on regex‑based rewrites for sensitive routes.
Impact:
Successful exploitation allows an unauthenticated remote attacker to bypass any authentication middleware (BasicAuth, ForwardAuth, DigestAuth, etc.) protecting a route. This grants unauthorised access to sensitive endpoints, enabling the attacker to read, modify, or delete protected resources without any credentials. The attack is network‑reachable, requires no user interaction, and has high confidentiality and integrity impact on downstream systems. All HTTP methods are affected, making the flaw critical for any Traefik deployment that uses ReplacePathRegex with a vulnerable configuration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
