CVE-2026-67309: CVE-2026-67309: Path Traversal and Authentication Bypass in Traefik RewriteTarget Middleware

CVE-2026-67309: Path Traversal and Authentication Bypass in Traefik RewriteTarget Middleware

Vulnerability ID: CVE-2026-67309
CVSS Score: 7.8
Published: 2026-08-06

A high-severity path traversal vulnerability exists in Traefik's Kubernetes Ingress NGINX provider. The flaw resides in the RewriteTarget middleware, which is auto-generated when an Ingress resource specifies the nginx.ingress.kubernetes.io/rewrite-target annotation. This allows remote, unauthenticated attackers to bypass route-level authentication and access restricted downstream endpoints by exploiting a parser differential.

TL;DR

Unauthenticated remote attackers can bypass Traefik's routing-layer security controls via relative dot-segment path traversals, gaining unauthorized access to restricted downstream backend resources.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-22
• Attack Vector: Network (AV:N)
• CVSS v4.0: 7.8 (High)
• EPSS Score: 0.00492
• Exploit Status: PoC (No Weaponized)
• CISA KEV Status: Not Listed

Affected Systems

• Traefik Proxy (Kubernetes Ingress NGINX provider environment with RewriteTarget enabled)
• Traefik: >= v3.7.0, <= v3.7.7 (Fixed in: v3.7.8)

Code Analysis

Commit: 759515b

Sanitize RewriteTarget middleware path replacements using Go JoinPath validation checks

Commit: 69259c3

Fix Gateway API test coverage and snippet rewrite action validation

Commit: b93f02c

Apply dynamic sanitization checks to replacePathRegex middlewares

Exploit Details

• Wiz Vulnerability Database: Exploit methodology and context details outlined in GHSA security advisory

Mitigation Strategies

• Upgrade Traefik to v3.7.8 or higher.
• Enforce strict Ingress path regular expression matching by requiring trailing slashes.
• Implement downstream validation rules to reject unnormalized URI segments.

Remediation Steps:

1. Identify all Kubernetes Ingress resources utilizing 'nginx.ingress.kubernetes.io/rewrite-target' or custom regex path replacement.
2. Audit matching rules to ensure wildcards are separated by explicit directory boundaries (e.g., '/api/(.*)').
3. Deploy Traefik v3.7.8 using Helm, YAML manifests, or the official Docker image update.
4. Verify incoming logs for HTTP 400 responses indicating rejected path traversal attempts.

References

• GitHub Security Advisory GHSA-8rxv-jg7p-wvg3
• VulnCheck Security Advisory

---

Read the full report for CVE-2026-67309 on our website for more details including interactive diagrams and full exploit analysis.