CVE-2026-65600
Description
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.
How to fix
- traefik traefik2.11.52, 3.6.23, 3.7.7 or later
- github.com/traefik/traefik/v22.11.52 or later
- github.com/traefik/traefik/v33.6.23, 3.7.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| traefik traefik | v < 2.11.52, 3.6.0 ≤ v < 3.6.23, 3.7.0 ≤ v < 3.7.7 | 2.11.52, 3.6.23, 3.7.7 |
| github.com/traefik/traefik/v2Go | v < 2.11.52 | 2.11.52 |
| github.com/traefik/traefik/v3Go | v < 3.6.23, 3.7.0 ≤ v < 3.7.7 | 3.6.23, 3.7.7 |
| github.com/traefik/traefikGo | v ≤ 1.7.34, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.