CVE-2026-65600

What it is

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

0.6% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-22 12:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-24 13:10 UTC Last updatedMost recent change to the record

Details

Published

2026-07-22 12:18 UTC

Last modified

2026-10-24 13:10 UTC

Exploit probability

0.6% · EPSS, next 30 days

Weakness

CWE-22 · Path traversal

Record status

Analyzed

Affected

• Traefik < 2.11.52
• Traefik < 3.6.23
• Traefik < 3.7.7

Attack profile CVSS 4.0 · 7.8

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

None