# CVE-2026-40912: Traefik authentication bypass in StripPrefixRegex middleware

Source: https://junglewise.ai/threats/cve-2026-40912-traefik-authentication-bypass-in-stripprefixregex-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-30. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-40912 · Severity: high · CVSS 8.2 · Published 2026-04-30

Traefik, a popular tool for routing and managing web traffic, contains a security flaw in how it handles specific URL prefixes. An attacker can bypass authentication requirements (like passwords or external login checks) by using specially crafted web addresses containing percent-encoded characters. This could allow unauthorized access to sensitive internal data or administrative interfaces that were supposed to be protected.

Technologies: [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik), [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2), [github.com/traefik/traefik/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3), [Traefik Labs Traefik Proxy](https://junglewise.ai/threats/technologies/traefik-proxy). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Traefik Labs](https://junglewise.ai/threats/vendors/traefik-labs).

## Quick answers

**Is CVE-2026-40912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40912 being exploited in the wild.

**How severe is CVE-2026-40912?** High severity, with a CVSS score of 8.2, published 30 April 2026.

**Which products and versions are affected?** github.com/traefik/traefik (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.34; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0,fixed=2.11.43; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=3.0.0-beta1,fixed=3.6.14,introduced=3.7.0-ea.1,fixed=3.7.0-rc.2, SEMVER:introduced=3.7.0-ea.1,fixed=3.7.0-rc.2.

**Is there a fix for CVE-2026-40912?** Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.43 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.0-rc.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40912 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40912?** Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/traefik/traefik/v2 (Go): upgrade to 2.11.43 or later

  ```sh
  go get github.com/traefik/traefik/v2@v2.11.43
  ```

- github.com/traefik/traefik/v3 (Go): upgrade to 3.7.0-rc.2 or later

  ```sh
  go get github.com/traefik/traefik/v3@v3.7.0-rc.2
  ```


## Technical details

An authentication bypass exists in Traefik's StripPrefixRegex middleware due to a Path/RawPath desynchronization. The middleware calculates the length of a prefix based on the decoded URL path but applies that length to slice the percent-encoded RawPath. When percent-encoded characters (like %2e for a dot) are present in the prefix, the resulting RawPath sent to authentication middlewares (ForwardAuth, BasicAuth, DigestAuth) is malformed (e.g., containing dot-segments like /./). These malformed paths may fail to match protected route patterns in the auth middleware, leading to an 'allow' decision. If the backend server subsequently normalizes the path per RFC 3986, it serves the protected content to the unauthenticated requester. Patches are available in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

## Affected products

- traefik traefik/v2 < 2.11.43
- traefik traefik/v3 >= 3.0.0-beta1, < 3.6.14; >= 3.7.0-ea.1, < 3.7.0-rc.2
- traefik traefik <= 1.7.34

## Identifiers

- CVE-2026-40912
- GHSA-6jwx-7vp4-9847
- GO-2026-5180

## Timeline

- 2026-04-24: advisory
- 2026-04-24: disclosed
- 2026-04-24: patched

## References

- [https://api.github.com/users/gouldnicholas](https://api.github.com/users/gouldnicholas)
- [https://github.com/gouldnicholas](https://github.com/gouldnicholas)
- [https://api.github.com/users/gouldnicholas/gists%7B/gist_id%7D](https://api.github.com/users/gouldnicholas/gists%7B/gist_id%7D)
- [https://api.github.com/users/gouldnicholas/repos](https://api.github.com/users/gouldnicholas/repos)
- [https://avatars.githubusercontent.com/u/40551787?v=4](https://avatars.githubusercontent.com/u/40551787?v=4)
- [https://api.github.com/users/gouldnicholas/events%7B/privacy%7D](https://api.github.com/users/gouldnicholas/events%7B/privacy%7D)

## Related threats

- [Traefik BasicAuth singleflight username enumeration via timing oracle](https://junglewise.ai/threats/cve-2026-88010-traefik-basicauth-singleflight-username-enumeration-via-timing)
- [Traefik readTimeout not enforced on HTTP/3 connections](https://junglewise.ai/threats/cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections)
- [Traefik ForwardAuth identity spoofing via header alias](https://junglewise.ai/threats/cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias)
- [Traefik rootless HTTP/1 request-target routing bypass](https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass)
- [Traefik HTTP request smuggling via unrestricted protocol upgrade](https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade)