CVE-2026-65600
published 2026-07-22CVE-2026-65600: Traefik versions = v3.6.0 = v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is…
PriorityP338medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.41%
34.6th percentile
Traefik versions = v3.6.0 = v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | traefik-rhel9 | — | — |
| github.com | traefik_traefik | 0 – 1.7.34 | — |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.52 | 2.11.52 |
| github.com | traefik_traefik_v3 | >= 0 < 3.6.23 | 3.6.23 |
| github.com | traefik_traefik_v3 | >= 3.7.0 < 3.7.7 | 3.7.7 |
| traefik | traefik | < 2.11.52 | 2.11.52 |
| traefik | traefik | >= 3.6.0 < 3.6.23 | 3.6.23 |
| traefik | traefik | >= 3.7.0 < 3.7.7 | 3.7.7 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.07.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa10.0CRITICAL
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
traefik: Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware
vendor_redhat·2026-07-22·CVSS 7.8
CVE-2026-65600 [HIGH] CWE-22 traefik: Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware
traefik: Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware
A flaw was found in Traefik. An unauthenticated remote attacker can bypass authentication due to a path traversal vulnerability in the ReplacePathRegex middleware. When this middleware is misconfigured, it forwards un-normalized paths, allowing a backend to resolve them to protected routes and grant unauthorized access. This bypass enables access to sensitive administrative interfaces.
Statement: This Critical flaw in Traefik's `ReplacePathRegex` middleware allows an unauthenticated remote attacker to bypass authentication. When the middleware is configured with a regex that captures user-controlled path segments without a mandatory path separator, it can forward un-normalized paths. This enables ac
GHSA
Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
ghsa·2026-08-06·CVSS 10.0
CVE-2026-65600 [CRITICAL] CWE-22 Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
## Summary
There is a critical authentication-bypass vulnerability in Traefik's `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator (for example `regex: "^/api(.*)"`, `replacement: "/$1"`), a crafted request can produce an un-normalized replacement path such as `/../admin`, which Traefik forwarded to the backend without validation. A backend that normalizes the path may resolve it to a protected route, letting an unauthenticated attacker reach resources located behind authentication middleware. This is the same class of issue that was fixed for `StripPrefix` in CVE-2026-48020; that post-replacement normalizat
VulDB
Traefik up to 2.11.51/3.6.0-3.7.6 ReplacePathRegex middleware path traversal (EUVD-2026-47644)
vuldb·2026-08-06·CVSS 5.3
CVE-2026-65600 [MEDIUM] Traefik up to 2.11.51/3.6.0-3.7.6 ReplacePathRegex middleware path traversal (EUVD-2026-47644)
A vulnerability labeled as critical has been found in Traefik up to 2.11.51/3.6.0-3.7.6. This vulnerability affects unknown code of the component ReplacePathRegex middleware. The manipulation results in path traversal.
This vulnerability was named CVE-2026-65600. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
GHSA
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware.
ghsa_unreviewed·2026-07-22
CVE-2026-65600 [HIGH] CWE-22 Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware.
Traefik versions = v3.6.0 = v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-80672 kernel: ntfs: fix u16 truncation of restart-area length check
bugzilla·2026-08-28·CVSS 7.8
CVE-2026-80672 [HIGH] CVE-2026-80672 kernel: ntfs: fix u16 truncation of restart-area length check
CVE-2026-80672 kernel: ntfs: fix u16 truncation of restart-area length check
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix u16 truncation of restart-area length check
ntfs_check_restart_area() validates that the $LogFile restart area and
its trailing log client record array fit within the system page size:
u16 ra_ofs, ra_len, ca_ofs;
...
ra_len = ca_ofs + le16_to_cpu(ra->log_clients) *
sizeof(struct log_client_record);
if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || ...)
return false;
ra_len is u16, but the right-hand side is computed in size_t
(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients
come straight from the on-disk restart area. With an on-disk
log_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and
s
Bugzilla
CVE-2026-65600 traefik: Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware
bugzilla·2026-07-22·CVSS 7.8
CVE-2026-65600 [HIGH] CVE-2026-65600 traefik: Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware
CVE-2026-65600 traefik: Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware
Traefik versions = v3.6.0 = v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23,
2026-07-22
Published