Summary
CVE-2026-67309 is a path traversal vulnerability in Traefik’s Kubernetes Ingress NGINX provider that enables complete route-level authentication bypass, affecting versions v3.7.0 through v3.7.7. The flaw resides in the RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation, which rewrites request paths without validating the normalized form of the resulting path. This allows a fully unauthenticated remote attacker to reach protected backend endpoints — secured with BasicAuth, DigestAuth, or ForwardAuth — with no credentials and no user interaction required. The vulnerability carries a CVSS v3.1 score of 9.1 (Critical).
Technical details
- Root cause: The
RewriteTargetmiddleware appliesReplaceAllString()andPathUnescape()to rewrite request paths based on regex captures from thenginx.ingress.kubernetes.io/rewrite-targetannotation, but performs no post-replacement normalization check. Unlike the patchedReplacePathRegexmiddleware, it does not verify that the rewritten path is equivalent to its normalized form, allowing dot-segment sequences (e.g.,..) to survive into the forwarded request. - Trigger conditions: The vulnerability is exploitable when: (1) the Kubernetes Ingress NGINX provider is enabled; (2) a public-facing Ingress uses a regex capture group that does not require a path separator — for example, path
/api(.*)with rewrite target/$1; and (3) a separate router on the same backend protects an endpoint (e.g.,/admin) with authentication middleware, and the backend normalizes dot segments before dispatching requests. - Attack vector: An unauthenticated remote attacker sends a crafted HTTP request such as
GET /api../admin. The public router matches the path via the regex/api(.*), and the middleware rewrites it to/../admin. Because no normalization check is applied after rewriting, this dot-segment path is forwarded to the backend, which resolves it to/admin— a protected endpoint on a separate authenticated router — without triggering any authentication challenge. - Impact: Complete bypass of route-level authentication (BasicAuth, DigestAuth, ForwardAuth). Attackers can read sensitive data and invoke privileged backend endpoints without any credentials, crossing the intended boundary between public and protected routes.
Affected software
- Traefik v3.7.0 through v3.7.7 (inclusive), when using the Kubernetes Ingress NGINX provider with a
rewrite-targetannotation containing a greedy or separator-free regex capture group
Severity
- CVSS v3.1 Base Score: 9.1 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate – upgrade: Update Traefik to v3.7.8, which applies a post-rewrite normalization check using
req.URL.JoinPath()and returns HTTP 400 if the normalized path differs from the rewritten path, preventing dot-segment traversal. - Workaround (if patching is not immediately possible): Modify Ingress regex patterns to explicitly require a path separator or end-of-path anchor before captured segments (e.g., change
/api(.*)to/api(/|$)(.*)). This prevents attacker-controlled dot-segment sequences from being captured and injected into the rewritten path. - Defense-in-depth: Do not rely solely on Traefik router-level authentication for backend protection. Enforce authentication at the backend application layer as well.
- Note: The entry-point
sanitizePath=trueoption does not mitigate this vulnerability, as the traversal sequences are introduced after sanitization, during the rewrite step.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.