Is CVE-2026-67309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67309 being exploited in the wild.

How severe is CVE-2026-67309?

High severity, with a CVSS score of 7.5, published 1 August 2026.

Which products and versions are affected?

github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) >= 3.7.0, <= 3.7.7, SEMVER:introduced=3.7.0,fixed=3.7.8.

Is there a fix for CVE-2026-67309?

Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.7.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67309 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67309?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67309: Traefik auth bypass via path traversal in Kubernetes Ingress NGINX provider

Q: Is there a fix for CVE-2026-67309?

Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.7.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-67309 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-67309?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67309 · Severity: high · CVSS 7.5 · Published 2026-08-01

A vulnerability in Traefik's Kubernetes Ingress NGINX provider allows attackers to bypass security rules and access protected parts of a website or application. By sending a specially crafted web request, an unauthorized user can trick the system into ignoring authentication requirements like passwords or IP restrictions. This could lead to the exposure of sensitive administrative data or unauthorized changes to the system.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik, Traefik Labs Traefik Proxy. Vendors: Go, Traefik, Traefik Labs.

Quick answers

Is CVE-2026-67309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67309 being exploited in the wild.
How severe is CVE-2026-67309?: High severity, with a CVSS score of 7.5, published 1 August 2026.
Which products and versions are affected?: github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) >= 3.7.0, <= 3.7.7, SEMVER:introduced=3.7.0,fixed=3.7.8.
Is there a fix for CVE-2026-67309?: Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.7.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67309 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67309?: Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/traefik/traefik/v3 (Go): upgrade to 3.7.8 or later
```
go get github.com/traefik/traefik/v3@v3.7.8
```

Technical details

A path traversal vulnerability exists in the internal RewriteTarget middleware of Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the 'nginx.ingress.kubernetes.io/rewrite-target' annotation with a regular expression that captures attacker-controlled text (e.g., '/api(.*)'), the middleware fails to validate the path normalization after the rewrite. An attacker can use dot-segments (e.g., '/api../admin') to traverse to a different path after the initial router selection. If the backend normalizes these paths, the request can reach endpoints intended to be protected by separate Traefik middlewares like BasicAuth or ForwardAuth. This issue is fixed in Traefik v3.7.8.

Affected products

Traefik Labs traefik/traefik/v3 >= 3.7.0, <= 3.7.7

Identifiers

CVE-2026-67309
GHSA-8rxv-jg7p-wvg3
GO-2026-6207

Timeline

2026-07-16: advisory: Initial advisory publication
2026-08-06: patched: Vulnerability patched in version 3.7.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.