CVE-2026-65600: Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex

What it is stated by the CNA

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.

weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

affected

traefik

published ranges

traefik < 2.11.52; traefik >= 3.6.0 < 3.6.23; traefik >= 3.7.0 < 3.7.7

fixed in

2.11.52; 3.6.23; 3.7.7

fixed by package (from OSV advisories)

github.com/traefik/traefik/v2 (Go): 2.11.52 GHSA-cxjq-mrr5-89rv GO-2026-6208github.com/traefik/traefik/v3 (Go): 3.6.23; 3.7.7 GHSA-cxjq-mrr5-89rv GO-2026-6208

later fixes (from OSV advisories)

github.com/traefik/traefik/v2 2.11.52 is inside a range CVE-2026-71324 (GHSA-3ccp-42pg-hgv6) lists as affected. That advisory is fixed in 2.11.53.github.com/traefik/traefik/v2 2.11.52 is inside a range CVE-2026-71325 (GHSA-62fc-8686-hfmq) lists as affected. That advisory is fixed in 2.11.54.github.com/traefik/traefik/v2 2.11.52 is inside a range CVE-2026-88007 (GHSA-qqjf-53cj-pwvv) lists as affected. That advisory is fixed in 2.11.57.github.com/traefik/traefik/v2 2.11.52 is inside a range CVE-2026-88008 (GHSA-w4v4-9rw7-5326) lists as affected. That advisory is fixed in 2.11.57.github.com/traefik/traefik/v2 2.11.52 is inside a range CVE-2026-88009 (GHSA-f52w-8j3h-j724) lists as affected. That advisory is fixed in 2.11.57.github.com/traefik/traefik/v2 2.11.52 is inside a range CVE-2026-88011 (GHSA-rf44-j88r-hh8c) lists as affected. That advisory is fixed in 2.11.56.

severity

7.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

assigned by

VulnCheck

published

2026-07-22

check us github.com vulncheck.com

Exploit code held, dated

exploit code

None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

5 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2026-65600', '2026-10-31T23:59:59.999999Z', now());