H4Ck2

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.11.48 Traefik versions prior to 3.6.19 Traefik versions prior to 3.7.3 **Description** An unauthenticated attacker can bypass route-level authentication and authorization in Traefik when `PathPrefix`-based public routes are used in combination with the `StripPrefix` middleware. By using a request path containing `..` or its percent-encoded form `%2e%2e`, a request can match a public route during the routing stage. After the prefix is stripped and the path is normalized, the request resolves to a protected path served by a separate authenticated router. This allows access to protected backend paths, such as admin or internal configuration endpoints, without satisfying the required authentication. This issue is caused by path normalization occurring after the prefix is stripped. **Recommendations** Update to version 2.11.48 or later. Update to version 3.6.19 or later. Update to version 3.7.3 or later. As a temporary workaround, use a stricter prefix boundary such as `PathRegexp('^/api(/|$)')` or use `PathPrefix('/api/')` combined with `StripPrefix('/api/')` to block the bypass.