Executive brief
Traefik is a popular open-source tool used to manage and route web traffic to different services. A security flaw in its path-handling component allows attackers to bypass password protection or other security rules by using specially crafted web addresses. This could allow an unauthorized person to access sensitive internal administrative panels or private data that should be restricted.
Technical details
An authentication bypass vulnerability exists in Traefik's StripPrefix middleware due to inconsistent path normalization between the routing and middleware stages. When a public router uses a PathPrefix rule and the StripPrefix middleware, an attacker can use dot-dot sequences (.. or %2e%2e) in the request path. These sequences allow the request to match a public route during initial routing; however, after the prefix is stripped and the path is normalized, the request resolves to a protected backend path (e.g., /admin). Because the initial routing matched a public rule, the authentication middleware attached to the intended protected router is never triggered. This issue is resolved in versions 2.11.48, 3.6.19, and 3.7.3.
Affected products
- Traefik Proxy Traefik < 2.11.48, >= 3.0.0-beta1 < 3.6.19, >= 3.7.0-ea.1 < 3.7.3
Timeline
- 2026-06-04: patched: Versions 2.11.48, 3.6.19, and 3.7.3 released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-xf64-8mw2-4gr2 published
- 2026-06-23: disclosed: CVE-2026-48020 published to NVD