CVE-2026-67309

[CVE catalog]

Severity

Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Published

Aug 1, 2026, 12:22:18 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.66% · Oct 25, 2026

A flaw was found in Traefik. This path traversal vulnerability exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware. A remote attacker can craft a special request that uses dot-segment traversal to bypass authentication mechanisms like BasicAuth, DigestAuth, or ForwardAuth. This allows access to otherwise protected administrative endpoints. github.com/traefik/traefik: Traefik: Authentication bypass via path traversal in RewriteTarget middleware A flaw was found in Traefik's Kubernetes Ingress NGINX provider RewriteTarget middleware (v3.7.0 through v3.7.7) where captured un-delimited regex segments are rewritten without post-replacement path normalization validation. In Kubernetes environments utilizing Traefik, a remote unauthenticated attacker can supply dot-segment traversal sequences in Ingress paths (e.g., /api../admin) that pass router matching, rewrite to a traversal path, and resolve on downstream backends to restricted administrative endpoints. This allows complete bypass of route-level authentication controls such as BasicAuth, DigestAuth, or ForwardAuth. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.