← Back to CVE Explorer

CVE-2026-65600

Full vulnerability record from the local CVENow database.

Description

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.

Severity
HIGH
CVSS score
7.8 (v4.0)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2026-07-22 12:18:20.297000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-65600",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-22T12:18:20.297",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex \"^/api(.*)\", replacement \"/$1\"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7."
    },
    {
      "lang": "es",
      "value": "Las versiones de Traefik menor o igual a v2.11.51, >= v3.6.0 menor o igual a v3.6.22, y >= v3.7.0 menor o igual a v3.7.6 contienen una omisión de autenticación a través de salto de ruta en el middleware ReplacePathRegex. Cuando ReplacePathRegex está configurado con una expresión regular que captura segmentos de ruta controlados por el usuario sin un separador de ruta obligatorio (p. ej., expresión regular \"^/api(.*)\", reemplazo \"/$1\"), el middleware reenvía la ruta reemplazada al backend sin validar que coincide con su forma normalizada. Un atacante remoto no autenticado puede enviar una solicitud manipulada (p. ej., GET /api../admin) que produce una ruta no normalizada como /../admin, que un backend que normaliza rutas resuelve a una ruta protegida, omitiendo el middleware de autenticación. Corregido en v2.11.52, v3.6.23, y v3.7.7."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "traefik",
          "product": "traefik",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/traefik/traefik/v2",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.11.52",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.11.52",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "traefik",
          "product": "traefik",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/traefik/traefik/v3",
          "versions": [
            {
              "version": "3.6.0",
              "lessThan": "3.6.23",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "3.6.23",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "traefik",
          "product": "traefik",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/traefik/traefik/v3",
          "versions": [
            {
              "version": "3.7.0",
              "lessThan": "3.7.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "3.7.7",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T19:08:10.643487Z",
          "id": "CVE-2026-65600",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.11.52",
              "matchCriteriaId": "CCFA016A-BDAB-4C4A-AFEB-2C7C877AE345"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:traefik:traefik:*:-:*:*:*:*:*:*",
              "versionStartIncluding": "3.6.0",
              "versionEndExcluding": "3.6.23",
              "matchCriteriaId": "99A7B51B-DB02-460E-A562-3738F7162E8F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:traefik:traefik:*:-:*:*:*:*:*:*",
              "versionStartIncluding": "3.7.0",
              "versionEndExcluding": "3.7.7",
              "matchCriteriaId": "673F7CFF-74B0-4E26-A1BE-5F560C289D20"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}