CVE-2026-48020: Traefik auth bypass via path normalization in StripPrefix middleware

CVE-2026-48020 · Severity: high · CVSS 3.1 · Published 2026-06-23

Traefik is a popular open-source tool used to manage and route web traffic to different services. A security flaw in its path-handling component allows attackers to bypass password protection or other security rules by using specially crafted web addresses. This could allow an unauthorized person to access sensitive internal administrative panels or private data that should be restricted.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-48020 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48020 being exploited in the wild.
How severe is CVE-2026-48020?
High severity, with a CVSS score of 3.1, published 23 June 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0,fixed=2.11.48; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=0,fixed=3.6.19, SEMVER:introduced=0,fixed=3.6.19,introduced=3.7.0-ea.1,fixed=3.7.3; Traefik Labs Traefik Proxy < 2.11.48, >= 3.0.0-beta1 < 3.6.19, >= 3.7.0-ea.1 < 3.7.3.
Is there a fix for CVE-2026-48020?
Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.48 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.6.19, 3.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48020 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48020?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v2 (Go): upgrade to 2.11.48 or later
    go get github.com/traefik/traefik/v2@v2.11.48
  • github.com/traefik/traefik/v3 (Go): upgrade to 3.6.19, 3.7.3 or later
    go get github.com/traefik/traefik/v3@v3.7.3

Technical details

An authentication bypass vulnerability exists in Traefik's StripPrefix middleware due to inconsistent path normalization between the routing and middleware stages. When a public router uses a PathPrefix rule and the StripPrefix middleware, an attacker can use dot-dot sequences (.. or %2e%2e) in the request path. These sequences allow the request to match a public route during initial routing; however, after the prefix is stripped and the path is normalized, the request resolves to a protected backend path (e.g., /admin). Because the initial routing matched a public rule, the authentication middleware attached to the intended protected router is never triggered. This issue is resolved in versions 2.11.48, 3.6.19, and 3.7.3.

Affected products

  • Traefik Proxy Traefik < 2.11.48, >= 3.0.0-beta1 < 3.6.19, >= 3.7.0-ea.1 < 3.7.3

Identifiers

  • CVE-2026-48020
  • GHSA-xf64-8mw2-4gr2
  • GO-2026-5752

Timeline

  • 2026-06-04: patched: Versions 2.11.48, 3.6.19, and 3.7.3 released
  • 2026-06-05: advisory: GitHub Security Advisory GHSA-xf64-8mw2-4gr2 published
  • 2026-06-23: disclosed: CVE-2026-48020 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.