DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-65600: CVE-2026-65600: Authentication Bypass via Path Traversal in Traefik ReplacePathRegex Middleware

#security #cve #cybersecurity

CVE-2026-65600: Authentication Bypass via Path Traversal in Traefik ReplacePathRegex Middleware

Vulnerability ID: CVE-2026-65600
CVSS Score: 7.8
Published: 2026-08-06

CVE-2026-65600 is a path traversal vulnerability in the ReplacePathRegex middleware component of Traefik. An unauthenticated remote attacker can exploit the vulnerability to inject directory traversal sequences. When Traefik forwards the resulting un-normalized path, downstream backend web servers normalize the request to execute administrative or protected paths, bypassing gateway-enforced security policies.

TL;DR

A path traversal vulnerability in Traefik's ReplacePathRegex middleware allows unauthenticated remote attackers to bypass gateway authentication controls by exploiting parser differentials and un-normalized path forwarding.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network
  • CVSS v4.0: 7.8 (High)
  • EPSS Score: 0.00674
  • Impact: Authentication Bypass
  • Exploit Status: Proof of Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • Traefik Proxy
  • Traefik Ingress Controller
  • Traefik: <= v2.11.51 (Fixed in: v2.11.52)
  • Traefik: >= v3.6.0, <= v3.6.22 (Fixed in: v3.6.23)
  • Traefik: >= v3.7.0, <= v3.7.6 (Fixed in: v3.7.7)

Code Analysis

Commit: 3f10dd4

Fix ReplacePathRegex middleware authentication bypass by adding JoinPath validation to verify path normalization post-replacement

Exploit Details

  • VulnCheck: Advisory detailing path traversal and authentication bypass concepts within Traefik middleware

Mitigation Strategies

  • Upgrade Traefik proxy instances to patched software versions.
  • Audit and restrict permissive regular expressions in ReplacePathRegex middleware definitions.
  • Deploy Web Application Firewall (WAF) filtering rules to block directory traversal sequences.

Remediation Steps:

  1. Review active routing configurations and identify any instances of the ReplacePathRegex middleware.
  2. Modify regular expression definitions to require strict path delimiters (e.g., using '^/api/(.)' instead of '^/api(.)').
  3. Update Traefik to version v2.11.52, v3.6.23, or v3.7.7 depending on the active release branch.
  4. Enable verbose debugging logs and monitor for HTTP 400 responses generated by the new URL validation logic.

References

Read the full report for CVE-2026-65600 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)