CVE-2026-65600: Traefik Auth Bypass Vulnerability

CVE-2026-65600 Overview

CVE-2026-65600 is an authentication bypass vulnerability in Traefik, an open-source reverse proxy and load balancer. The flaw affects the ReplacePathRegex middleware when configured with regex patterns that capture user-controlled path segments without requiring a path separator. An unauthenticated remote attacker can craft requests that produce un-normalized paths, which backend services then normalize to reach protected routes. This behavior bypasses authentication middleware chained in front of the backend. The vulnerability is classified under path traversal [CWE-22] and affects Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6. Fixed releases are v2.11.52, v3.6.23, and v3.7.7.

Critical Impact
Unauthenticated remote attackers can bypass authentication middleware and access protected backend routes through crafted path traversal sequences.

Affected Products

Traefik <= v2.11.51
Traefik >= v3.6.0 <= v3.6.22
Traefik >= v3.7.0 <= v3.7.6

Discovery Timeline

2026-07-22 - CVE-2026-65600 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65600

Vulnerability Analysis

The ReplacePathRegex middleware in Traefik performs regex-based path rewriting before forwarding requests to backend services. When operators configure a regex like ^/api(.*) with replacement /$1, the capture group accepts any characters, including path traversal sequences. Traefik constructs the new path from the replacement template and forwards it to the backend without verifying that the resulting path matches its normalized form.

Backends that perform their own path normalization then resolve the traversal sequences, potentially reaching routes that were protected by authentication middleware layered ahead of the rewrite. The middleware trust boundary breaks because Traefik and the backend disagree on what path is being requested.

Root Cause

The root cause is missing path normalization validation after regex substitution. ReplacePathRegex does not compare the rewritten path against its canonical form before proxying. Any regex capture group that lacks a mandatory path separator anchor allows attacker-controlled .. segments to pass through untouched.

Attack Vector

An attacker sends a request such as GET /api../admin to a Traefik instance configured with a vulnerable ReplacePathRegex rule. The middleware matches ^/api(.*) with ../admin in the capture group and rewrites the path to /../admin. Traefik forwards this un-normalized path to the backend. The backend normalizes /../admin to /admin, reaching a route that authentication middleware in front of the rewrite step never inspected. No credentials or user interaction are required.

The vulnerability manifests entirely at the routing layer. See the GitHub Security Advisory for the full technical writeup.

Detection Methods for CVE-2026-65600

Indicators of Compromise

Requests containing .. sequences directed at paths handled by ReplacePathRegex middleware, such as /api../admin or /api../internal.
HTTP access logs showing 200 responses to backend routes that should require authentication.
Backend application logs recording requests to administrative endpoints with no preceding authentication event.

Detection Strategies

Audit all Traefik dynamic and static configurations for ReplacePathRegex middlewares whose regex capture groups do not enforce a leading /.
Correlate Traefik access logs with backend application logs to identify path mismatches between proxy and origin.
Deploy web application firewall rules that reject request paths containing .. before they reach Traefik.

Monitoring Recommendations

Alert on any request path containing ../ or encoded variants such as %2e%2e%2f reaching Traefik ingress.
Monitor authenticated backend routes for requests lacking a corresponding session or token validation event.
Track Traefik version inventory across environments to identify hosts still running vulnerable releases.

How to Mitigate CVE-2026-65600

Immediate Actions Required

Upgrade Traefik to v2.11.52, v3.6.23, or v3.7.7 depending on the current major version.
Review every ReplacePathRegex definition and update regex patterns to require a path separator after the prefix, for example ^/api/(.*).
Place authentication middleware behind, not in front of, path-rewriting middleware where feasible so the backend evaluates the final normalized path.

Patch Information

The Traefik maintainers released fixes in versions v2.11.52, v3.6.23, and v3.7.7. The patched releases validate that the rewritten path matches its normalized form before forwarding. Refer to the VulnCheck Advisory on Traefik for release notes and additional remediation guidance.

Workarounds

Rewrite vulnerable middleware regex to anchor the capture group after a required separator, such as ^/api/(.*) with replacement /$1.
Terminate requests containing .. or encoded traversal sequences at an upstream WAF or ingress filter.
Configure backend services to reject any request path containing unresolved traversal segments before normalization.

bash

# Example: safer ReplacePathRegex configuration (Traefik dynamic config)
http:
  middlewares:
    strip-api-prefix:
      replacePathRegex:
        regex: "^/api/(.*)"
        replacement: "/$1"