CVE-2026-67309: Traefik Path Traversal Vulnerability

CVE-2026-67309 Overview

CVE-2026-67309 is a path traversal vulnerability [CWE-22] in Traefik versions >= v3.7.0 and <= v3.7.7. The flaw resides in the Kubernetes Ingress NGINX provider's RewriteTarget middleware, generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. Attackers can craft requests containing dot-segment traversal sequences that bypass route-level authentication middlewares such as BasicAuth, DigestAuth, or ForwardAuth. The upstream backend then normalizes the rewritten path and resolves it to a protected endpoint. Traefik released a fix in version v3.7.8.

Critical Impact
Unauthenticated attackers can reach protected backend endpoints by exploiting the rewrite middleware to produce traversal paths that bypass authentication routers.

Affected Products

Traefik v3.7.0 through v3.7.7
Deployments using the Kubernetes Ingress NGINX provider
Ingress configurations using nginx.ingress.kubernetes.io/rewrite-target with regex capture groups lacking a required path separator

Discovery Timeline

2026-08-01 - CVE-2026-67309 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67309

Vulnerability Analysis

The vulnerability stems from how Traefik's RewriteTarget middleware translates the nginx.ingress.kubernetes.io/rewrite-target annotation into a regex-based path rewrite. When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator, the middleware performs the substitution without validating the resulting path.

For example, an Ingress path of /api(.*) combined with a rewrite target of /$1 accepts a request like /api../admin. Traefik matches the public router, rewrites the path to /../admin, and forwards it upstream without normalizing dot segments post-replacement. A backend that normalizes path traversal sequences then resolves the request to /admin, an endpoint intended to be reachable only through a separate router protected by BasicAuth, DigestAuth, or ForwardAuth.

Root Cause

The root cause is missing post-rewrite normalization and validation. Traefik trusts the output of the regex substitution and forwards paths containing .. segments without collapsing them or rejecting them. The routing decision occurs against the original path, while the backend acts on the normalized traversal path, creating a routing-versus-normalization desynchronization.

Attack Vector

Exploitation requires only network access to the Traefik ingress. An attacker sends an HTTP request to a public route whose rewrite regex captures unbounded text. By embedding .. sequences in the captured portion, the attacker steers the rewritten path to a sibling route protected by authentication middleware.

text

// Traefik go.mod change from the v3.7.8 fix branch
module github.com/traefik/traefik/v3

-go 1.25.0
+go 1.26.0

require (
    github.com/BurntSushi/toml v1.6.0

Source: Traefik commit b93f02c. The fix branch merges v3.7 into master and includes the normalization changes that reject or collapse traversal sequences produced by rewrite substitution.

Detection Methods for CVE-2026-67309

Indicators of Compromise

HTTP access logs containing request paths with encoded or literal .. segments immediately following an Ingress prefix that uses a rewrite annotation.
Backend application logs recording access to protected endpoints (for example /admin) without corresponding authentication middleware log entries in Traefik.
Mismatch between Traefik router match logs and upstream request paths for the same request ID.

Detection Strategies

Inspect Ingress resources for nginx.ingress.kubernetes.io/rewrite-target annotations combined with regex patterns like (.*) that omit a required leading separator.
Alert on any request where the rewritten path contains /../ before it leaves Traefik.
Correlate authentication middleware bypass patterns by comparing router-level auth events to backend access records.

Monitoring Recommendations

Enable Traefik access logs in JSON format and forward them to a central analytics platform for path anomaly detection.
Monitor for spikes in 2xx responses on protected endpoints from source IPs that never authenticated.
Track the Traefik version deployed across clusters and flag any instance in the vulnerable range v3.7.0 to v3.7.7.

How to Mitigate CVE-2026-67309

Immediate Actions Required

Upgrade Traefik to v3.7.8 or later across all clusters running the Kubernetes Ingress NGINX provider.
Audit every Ingress resource for nginx.ingress.kubernetes.io/rewrite-target annotations and identify regex capture groups that do not enforce a path separator.
Reroute any protected endpoints so they are not reachable via traversal from a sibling public route on the same host.

Patch Information

The fix is available in Traefik v3.7.8. See the Traefik security advisory GHSA-8rxv-jg7p-wvg3 and the VulnCheck advisory for full details. The upstream commits are 69259c3 and b93f02c.

Workarounds

Rewrite regex patterns to require a path separator after the prefix, for example /api/(.*) instead of /api(.*).
Add an explicit middleware that rejects request paths containing .. segments before rewriting occurs.
Move sensitive endpoints to a distinct host or router that cannot be reached from any rewrite-enabled route.

bash

# Example hardened Ingress annotation and path
# Require the trailing slash so attacker input cannot start with '..'
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
    - http:
        paths:
          - path: /api/(.*)
            pathType: ImplementationSpecific