Executive brief
A critical security flaw has been identified in Traefik, a popular tool used to route and manage web traffic. The vulnerability allows an unauthorized person to bypass security checks and access protected areas of a website or application by sending a specially crafted web request. This could lead to the exposure of sensitive administrative data or unauthorized changes to the system. Organizations using Traefik should update to the latest patched versions immediately to ensure their internal resources remain protected.
Technical details
A path traversal vulnerability exists in Traefik's ReplacePathRegex middleware when configured with regular expressions that capture user-controlled path segments without mandatory separators (e.g., '^/api(.*)'). The root cause is located in the ServeHTTP function of the replacepathregex package, which fails to perform post-replacement path normalization validation. An unauthenticated remote attacker can craft a request (e.g., '/api../admin') that, after regex substitution, produces an un-normalized path (e.g., '/../admin'). If the backend service normalizes this path, the attacker can bypass Traefik's authentication middleware to access protected resources. This issue has been addressed in versions 2.11.52, 3.6.23, and 3.7.7 by implementing a check that rejects requests where the replaced path does not match its normalized form.
Affected products
- traefik traefik <= 1.7.34
- traefik traefik/v2 <= 2.11.51
- traefik traefik/v3 <= 3.6.22, >= 3.7.0, <= 3.7.6
Timeline
- 2026-07-09: disclosed: Initial publication by rtribotte
- 2026-08-06: advisory: GitHub Advisory published