CVE-2026-65600: 
Traefik vulnerability analysis and mitigation

CVE-2026-65600 is an authentication bypass vulnerability via path traversal in Traefik's ReplacePathRegex middleware, classified as High severity. It affects Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6. The vulnerability was published on July 22, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 10.0 (Critical) and a CVSS v4.0 base score of 7.8 (High) (GitHub Advisory, Github Advisory). This is the same class of issue previously fixed for the StripPrefix middleware in CVE-2026-48020, but the post-replacement normalization check was not applied to ReplacePathRegex (GitHub Advisory).

The root cause (CWE-22: Path Traversal) lies in pkg/middlewares/replacepathregex/replace_path_regex.go (function ServeHTTP, lines 56–74), where after regex substitution produces a new path, the middleware forwards it to the backend without verifying that the path matches its normalized form (GitHub Advisory). When ReplacePathRegex is configured with a pattern like ^/api(.*) and replacement /$1, an attacker sends a request such as GET /api../admin; Traefik's sanitizePath passes api.. unchanged (it is a valid path segment, not a dot-segment), the router matches PathPrefix(/api) on the public (unauthenticated) router, and the regex substitution produces /../admin. Because no normalization check exists, this un-normalized path is forwarded to the backend, which (e.g., Express, Flask, Django, Spring, ASP.NET) normalizes it to /admin, resolving to the protected route. The suggested fix is to add a JoinPath equality check after substitution and reject requests with HTTP 400 if the replaced path does not match its normalized form (GitHub Advisory). A URL-encoded variant (/api%2e%2e/admin) also works as an attack vector.

Successful exploitation allows an unauthenticated remote attacker to bypass any authentication middleware (BasicAuth, ForwardAuth, DigestAuth) protecting backend routes, gaining unauthorized access to sensitive or administrative resources. Both read and write operations (GET, POST, PUT, DELETE) bypass authentication, meaning attackers can exfiltrate confidential data and potentially modify or delete protected resources (GitHub Advisory). The vulnerability affects the subsequent (backend) system's confidentiality and integrity at a high level, while availability is not directly impacted. Deployments using ReplacePathRegex for prefix stripping — a common, documented configuration pattern — are at risk (Github Advisory).

1. Reconnaissance: Identify internet-facing Traefik instances running affected versions (<= v2.11.51, v3.6.0–v3.6.22, or v3.7.0–v3.7.6) using tools like Shodan or Censys, or by inspecting HTTP response headers (e.g., Server: Traefik).
2. Identify exploitable configuration: Confirm the target uses ReplacePathRegex middleware with a regex pattern that captures user-controlled path segments without a mandatory path separator (e.g., ^/api(.*) with replacement /$1), and that a protected route (e.g., /admin) exists behind authentication middleware on a separate router.
3. Craft the bypass request: Send a crafted HTTP request that injects a traversal sequence into the public path prefix, such as:

   GET /api../admin HTTP/1.1
   Host: target.example.com

   Or use the URL-encoded variant: GET /api%2e%2e/admin
4. Bypass authentication: Traefik's router matches /api../admin against the public PathPrefix(/api) router (no auth middleware), applies the regex substitution to produce /../admin, and forwards this un-normalized path to the backend.
5. Access protected resource: The backend framework normalizes /../admin to /admin and serves the protected content without requiring authentication, granting the attacker full access to the protected route (GitHub Advisory).

• Network: HTTP requests to paths matching the pattern /<public_prefix>..<protected_route> (e.g., /api../admin, /api%2e%2e/admin) in access logs; unexpected successful (HTTP 200) responses to paths that should return HTTP 401 or 403.
• Logs: Traefik access logs showing requests with path segments containing .. or %2e%2e immediately following a known public API prefix (e.g., /api../, /api%2e%2e/); backend application logs showing requests to protected routes (e.g., /admin) arriving without authentication headers.
• Logs: Absence of Authorization headers in backend requests to routes that are expected to be protected by BasicAuth or ForwardAuth middleware, correlated with successful HTTP 200 responses.
• Network: Repeated probing of multiple path traversal variants against the same public prefix endpoint from a single source IP, suggesting automated scanning (GitHub Advisory).

Upgrade Traefik to the patched versions: v2.11.52 (for v2.x users), v3.6.23 (for v3.6.x users), or v3.7.7 (for v3.7.x users) (GitHub Advisory). As a configuration-level workaround, update ReplacePathRegex patterns to include a mandatory path separator before the capture group (e.g., change ^/api(.*) to ^/api/(.*)) — this prevents the traversal sequence from being injected, as the same structural narrowing mitigated CVE-2026-48020 for StripPrefix. Additionally, consider implementing path normalization validation in backend services as a defense-in-depth measure (GitHub Advisory).

The vulnerability was reported by security researcher C-h4ck-0 and published by Traefik maintainer rtribotte via a GitHub Security Advisory on July 9, 2026 (GitHub Advisory). Red Hat tracked the issue as urgent severity in their Bugzilla system, indicating concern for downstream products that bundle Traefik (Red Hat Bugzilla). VulnCheck also published an advisory covering the issue (Github Advisory). No broader social media or community commentary has been identified at this time.