{"uuid": "dea959ff-1061-40df-8513-9020bfe1c65a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-cxjq-mrr5-89rv", "type": "seen", "source": "https://gist.github.com/alon710/1c8a7f596af5fdd35dfa04b0effb7a0b", "content": "# CVE-2026-65600: CVE-2026-65600: Authentication Bypass via Path Traversal in Traefik ReplacePathRegex Middleware\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-65600\n\n## Summary\nCVE-2026-65600 is a path traversal vulnerability in the ReplacePathRegex middleware component of Traefik. An unauthenticated remote attacker can exploit the vulnerability to inject directory traversal sequences. When Traefik forwards the resulting un-normalized path, downstream backend web servers normalize the request to execute administrative or protected paths, bypassing gateway-enforced security policies.\n\n## TL;DR\nA path traversal vulnerability in Traefik's ReplacePathRegex middleware allows unauthenticated remote attackers to bypass gateway authentication controls by exploiting parser differentials and un-normalized path forwarding.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v4.0**: 7.8 (High)\n- **EPSS Score**: 0.00674\n- **Impact**: Authentication Bypass\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Traefik Proxy\n- Traefik Ingress Controller\n- **Traefik**: <= v2.11.51 (Fixed in: `v2.11.52`)\n- **Traefik**: >= v3.6.0, <= v3.6.22 (Fixed in: `v3.6.23`)\n- **Traefik**: >= v3.7.0, <= v3.7.6 (Fixed in: `v3.7.7`)\n\n## Mitigation\n\n- Upgrade Traefik proxy instances to patched software versions.\n- Audit and restrict permissive regular expressions in ReplacePathRegex middleware definitions.\n- Deploy Web Application Firewall (WAF) filtering rules to block directory traversal sequences.\n\n**Remediation Steps:**\n1. Review active routing configurations and identify any instances of the ReplacePathRegex middleware.\n2. Modify regular expression definitions to require strict path delimiters (e.g., using '^/api/(.*)' instead of '^/api(.*)').\n3. Update Traefik to version v2.11.52, v3.6.23, or v3.7.7 depending on the active release branch.\n4. Enable verbose debugging logs and monitor for HTTP 400 responses generated by the new URL validation logic.\n\n## References\n\n- [GHSA-cxjq-mrr5-89rv: Authentication Bypass via ReplacePathRegex](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv)\n- [NVD - CVE-2026-65600 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-65600)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-65600) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T18:31:30.227506Z"}