PT-2026-48684 · Traefik · Traefik
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Traefik versions prior to 2.11.48
Traefik versions prior to 3.6.19
Traefik versions prior to 3.7.3
Description
An unauthenticated attacker can bypass route-level authentication and authorization in Traefik when
PathPrefix-based public routes are used in combination with the StripPrefix middleware. By using a request path containing .. or its percent-encoded form %2e%2e, a request can match a public route during the routing stage. After the prefix is stripped and the path is normalized, the request resolves to a protected path served by a separate authenticated router. This allows access to protected backend paths, such as admin or internal configuration endpoints, without satisfying the required authentication. This issue is caused by path normalization occurring after the prefix is stripped.Recommendations
Update to version 2.11.48 or later.
Update to version 3.6.19 or later.
Update to version 3.7.3 or later.
As a temporary workaround, use a stricter prefix boundary such as
PathRegexp('^/api(/|$)') or use PathPrefix('/api/') combined with StripPrefix('/api/') to block the bypass.Exploit
Fix
Path traversal
Authentication Bypass Using an Alternate Path or Channel
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Traefik