CVE-2026-48020

[CVE catalog]

Severity

Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Published

Jun 11, 2026, 1:26:57 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.78% · Oct 25, 2026

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This vulnerability exists in the StripPrefix middleware, allowing an unauthenticated attacker to bypass route-level authentication and authorization. By crafting a request path containing '..' or its percent-encoded form, an attacker can access protected backend paths, such as administrative or internal configuration endpoints, without proper authentication. This could lead to unauthorized information disclosure or modification of sensitive settings. github.com/traefik/traefik: Traefik: Authentication bypass in StripPrefix middleware allows unauthorized access to protected paths This is an Important authentication bypass flaw in Traefik's StripPrefix middleware, affecting Red Hat OpenShift Dev Spaces. An unauthenticated remote attacker can exploit this by crafting a specific request path, gaining access to protected backend resources like administrative or internal configuration endpoints. This could lead to unauthorized information disclosure or modification of sensitive settings. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.