medium CVSS 5.3

CVE-2026-65600·Traefik vulnerability

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.

Severity
medium
Software
Traefik
Fixed in
3.7.7
Published

Affected versions

From: 3.7.0

Until: 3.7.7

Fixed in: 3.7.7

How to fix this CVE

Upgrade Traefik to version 3.7.7 or later to address a path traversal vulnerability in the ReplacePathRegex middleware that allows unauthenticated attackers to bypass authentication controls. Organizations using versions 3.7.0 through 3.7.6 should prioritize this update, as the flaw enables crafted requests to reach protected backend routes without proper authorization.

sudo dnf update traefik

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET /api\.\./ OR GET /api%2e%2e/ OR POST /api/../admin OR GET /service/../../../admin followed by HTTP 200 or 3xx response when authentication should have been required

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block HTTP requests containing unencoded path traversal sequences (../, ..\ ) or encoded variants (%2e%2e%2f, %252e%252e%252f) in the request path before they reach Traefik. Implement strict path normalization rules that reject requests with mixed segments that resolve to parent directories.

How to check if you are affected

  1. Check installed Traefik version: traefik version or docker inspect $(docker ps -q -f ancestor=traefik) | grep -i version
  2. Verify ReplacePathRegex middleware configuration: grep -r "ReplacePathRegex" /etc/traefik/ or check dynamic configuration files for regex patterns without mandatory separators
  3. Search logs for suspicious path traversal patterns: grep -E '\.\./' /var/log/traefik/access.log or check access logs for requests containing encoded traversal sequences like %2e%2e%2f
  4. After upgrading, confirm the new version: traefik version should report 3.7.7 or later

FAQ

What is CVE-2026-65600?

This vulnerability affects Traefik's ReplacePathRegex middleware, which fails to normalize paths after applying regex-based replacements. An attacker can craft requests with path traversal sequences that bypass authentication middleware and reach protected backend resources.

Is CVE-2026-65600 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are available, though organizations should still prioritize patching due to the authentication bypass risk.

What versions of Traefik are affected by CVE-2026-65600?

Versions 3.7.0 through 3.7.6 are affected. Additionally, versions 2.x up to 2.11.51 and 3.6.0 through 3.6.22 are vulnerable. Traefik 3.7.7, 3.6.23, and 2.11.52 contain the fix.

How do I check if my server is vulnerable to CVE-2026-65600?

Run 'traefik version' and compare against the affected ranges. If you're running 3.7.0–3.7.6, check your dynamic configuration files for ReplacePathRegex rules with regex patterns lacking mandatory path separators (e.g., '^/api(.*)' replacement '/$1').

Does Defensia detect CVE-2026-65600?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Traefik is installed on a monitored server, CVE-2026-65600 will appear in your dashboard with remediation steps.

Related Traefik CVEs

CVE-2026-53622CVSS 10Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which fails to match wildcard host patterns (e.g., *.example.com) or case variants of the configured hostname. Because the handshake falls back to the default TLS configuration — which may not require client certificates — a client can complete the QUIC handshake without presenting a certificate, while the subsequent HTTP routing layer still dispatches the request to a backend protected by a router-specific mTLS policy. The issue affects deployments where HTTP/3 is enabled, a router uses a wildcard Host rule or case-insensitive hostname matching, a router-specific TLSOptions enforces client certificate authentication, and UDP access to the entrypoint is reachable by an attacker. This vulnerability is fixed in versions 3.7.3, 3.6.18, and 2.11.51.
CVE-2026-48491CVSS 10Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host(*.example.com) with stricter TLS options (for example RequireAndVerifyClientCert), SNICheck resolves the TLS options for the HTTP Host header using exact map lookups only and never applies wildcard matching. If another permissive SNI is served on the same entrypoint, an attacker can complete the TLS handshake under the permissive options and then send an HTTP Host header targeting the wildcard-protected backend, reaching it without presenting a client certificate. This affects the regular HTTPS / HTTP-2 path and does not require HTTP/3. This vulnerability is fixed in 3.7.3.
CVE-2026-48020CVSS 10Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.
CVE-2026-54763CVSS 10Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
CVE-2026-44774CVSS 9.9Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-65600. Free for 1 server.

Get started free