CVE-2026-65600 – Authentication Bypass – Traefik ≤ v2.11.51, v3.6.0–v3.6.22, v3.7.0–v3.7.6

Summary

CVE-2026-65600 is a high-severity authentication bypass vulnerability via path traversal in Traefik’s ReplacePathRegex middleware, affecting all v2 releases up to and including v2.11.51, v3.6.x up to v3.6.22, and v3.7.x up to v3.7.6. An unauthenticated remote attacker can craft a single HTTP request that produces an un-normalized path, which a downstream backend resolves to a protected route — fully circumventing any authentication middleware (BasicAuth, ForwardAuth, DigestAuth, etc.) guarding it. The vulnerability carries a CVSS 4.0 score of 7.8 (High), with high confidentiality and integrity impact on downstream systems.

Technical details

• Root cause: The ReplacePathRegex middleware performs regex-based path substitution but does not validate that the resulting path matches its normalized form before forwarding the request to the backend. This mirrors the same class of issue previously patched in the StripPrefix middleware (CVE-2026-48020), which was not concurrently applied to ReplacePathRegex.
• Trigger condition: The vulnerability is exploitable when ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator — for example, regex: "^/api(.*)" with replacement: "/$1". Configurations using a mandatory slash before the capture group (e.g., ^/api/(.*)) are not exploitable via this technique.
• Attack vector: An unauthenticated attacker sends a crafted HTTP request such as GET /api../admin. The middleware’s regex matches the /api prefix, captures ../admin, and produces the replacement path /../admin. Traefik forwards this un-normalized path to the backend without sanitization. The backend normalizes /../admin to /admin and serves the protected resource. URL-encoded variants (e.g., GET /api%2e%2e/admin) achieve the same result.
• Impact: Complete bypass of any authentication middleware protecting routes on a separate Traefik router. Both read and write HTTP methods (GET, POST, PUT, DELETE) are affected, allowing an attacker to access or modify protected resources without any credentials.

Affected software

• Traefik v2.x: all versions ≤ v2.11.51
• Traefik v3.6.x: v3.6.0 through v3.6.22 (inclusive)
• Traefik v3.7.x: v3.7.0 through v3.7.6 (inclusive)

Severity

CVSS 4.0 Score: 7.8 (High)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Key metrics: Network-based attack vector, no attack complexity, no privileges required, no user interaction required. High confidentiality and integrity impact on subsequent/downstream systems.

Mitigation and recommended actions

• Immediate — upgrade to a patched release:
  • Traefik v2.x → upgrade to v2.11.52 or later
  • Traefik v3.6.x → upgrade to v3.6.23 or later
  • Traefik v3.7.x → upgrade to v3.7.7 or later
• If patching is not immediately possible:
  • Audit all ReplacePathRegex middleware configurations and replace any regex pattern that does not enforce a mandatory path separator before the capture group (e.g., change ^/api(.*) to ^/api/(.*)). This eliminates the traversal opportunity for that specific pattern.
  • Restrict inbound access to Traefik ingress points via network-level controls (firewall rules, WAF) to limit exposure while patching is scheduled.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-65600 at NIST
• GitHub Security Advisory GHSA-cxjq-mrr5-89rv