Executive brief
A vulnerability in Traefik's Kubernetes Ingress NGINX provider allows attackers to bypass security rules and access protected parts of a website or application. By sending a specially crafted web request, an unauthorized user can trick the system into ignoring authentication requirements like passwords or IP restrictions. This could lead to the exposure of sensitive administrative data or unauthorized changes to the system.
Technical details
A path traversal vulnerability exists in the internal RewriteTarget middleware of Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the 'nginx.ingress.kubernetes.io/rewrite-target' annotation with a regular expression that captures attacker-controlled text (e.g., '/api(.*)'), the middleware fails to validate the path normalization after the rewrite. An attacker can use dot-segments (e.g., '/api../admin') to traverse to a different path after the initial router selection. If the backend normalizes these paths, the request can reach endpoints intended to be protected by separate Traefik middlewares like BasicAuth or ForwardAuth. This issue is fixed in Traefik v3.7.8.
Affected products
- Traefik Labs traefik/traefik/v3 >= 3.7.0, <= 3.7.7
Timeline
- 2026-07-16: advisory: Initial advisory publication
- 2026-08-06: patched: Vulnerability patched in version 3.7.8