Summary
CVE-2026-65600 is a high-severity authentication bypass vulnerability via path traversal in Traefik’s ReplacePathRegex middleware, affecting all v2 releases up to and including v2.11.51, v3.6.x up to v3.6.22, and v3.7.x up to v3.7.6. An unauthenticated remote attacker can craft a single HTTP request that produces an un-normalized path, which a downstream backend resolves to a protected route — fully circumventing any authentication middleware (BasicAuth, ForwardAuth, DigestAuth, etc.) guarding it. The vulnerability carries a CVSS 4.0 score of 7.8 (High), with high confidentiality and integrity impact on downstream systems.
Technical details
- Root cause: The
ReplacePathRegexmiddleware performs regex-based path substitution but does not validate that the resulting path matches its normalized form before forwarding the request to the backend. This mirrors the same class of issue previously patched in theStripPrefixmiddleware (CVE-2026-48020), which was not concurrently applied toReplacePathRegex. - Trigger condition: The vulnerability is exploitable when
ReplacePathRegexis configured with a regex that captures user-controlled path segments without a mandatory path separator — for example,regex: "^/api(.*)"withreplacement: "/$1". Configurations using a mandatory slash before the capture group (e.g.,^/api/(.*)) are not exploitable via this technique. - Attack vector: An unauthenticated attacker sends a crafted HTTP request such as
GET /api../admin. The middleware’s regex matches the/apiprefix, captures../admin, and produces the replacement path/../admin. Traefik forwards this un-normalized path to the backend without sanitization. The backend normalizes/../adminto/adminand serves the protected resource. URL-encoded variants (e.g.,GET /api%2e%2e/admin) achieve the same result. - Impact: Complete bypass of any authentication middleware protecting routes on a separate Traefik router. Both read and write HTTP methods (GET, POST, PUT, DELETE) are affected, allowing an attacker to access or modify protected resources without any credentials.
Affected software
- Traefik v2.x: all versions ≤ v2.11.51
- Traefik v3.6.x: v3.6.0 through v3.6.22 (inclusive)
- Traefik v3.7.x: v3.7.0 through v3.7.6 (inclusive)
Severity
CVSS 4.0 Score: 7.8 (High)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Key metrics: Network-based attack vector, no attack complexity, no privileges required, no user interaction required. High confidentiality and integrity impact on subsequent/downstream systems.
Mitigation and recommended actions
- Immediate — upgrade to a patched release:
- Traefik v2.x → upgrade to v2.11.52 or later
- Traefik v3.6.x → upgrade to v3.6.23 or later
- Traefik v3.7.x → upgrade to v3.7.7 or later
- If patching is not immediately possible:
- Audit all
ReplacePathRegexmiddleware configurations and replace any regex pattern that does not enforce a mandatory path separator before the capture group (e.g., change^/api(.*)to^/api/(.*)). This eliminates the traversal opportunity for that specific pattern. - Restrict inbound access to Traefik ingress points via network-level controls (firewall rules, WAF) to limit exposure while patching is scheduled.
- Audit all
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

