CVE-2026-67309: 
Traefik vulnerability analysis and mitigation

CVE-2026-67309 is a path traversal vulnerability in Traefik's Kubernetes Ingress NGINX provider that enables unauthenticated route-level authentication bypass. It affects Traefik versions >= v3.7.0 and <= v3.7.7, and was disclosed on August 1, 2026, with a fix available in v3.7.8. The vulnerability arises in the RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. It carries a CVSS v4 base score of 7.8 (High) (GitHub Advisory, Traefik Advisory).

The root cause is classified as CWE-22 (Path Traversal) and CWE-288 (Authentication Bypass Using an Alternate Path or Channel). When an Ingress path uses a regex such as /api(.*) with a rewrite target of /$1, the RewriteTarget middleware captures attacker-controlled text (e.g., ../admin) and constructs a dot-segment traversal path (/../admin) without applying post-replacement normalization validation. Specifically, after calling url.PathUnescape, the middleware sets req.URL.RawPath and req.URL.Path directly and forwards the request without checking whether req.URL.Path equals its normalized form — a check that the sibling ReplacePathRegex middleware (patched in GHSA-cxjq-mrr5-89rv) does perform. Because routing occurs before middleware execution, the protected router (e.g., one enforcing BasicAuth on /admin) is never reconsidered, and the backend's own path normalization resolves /../admin to /admin, granting access. The vulnerable code resides in pkg/middlewares/ingressnginx/rewritetarget/rewrite_target.go:85-157 (Traefik Advisory).

An unauthenticated remote attacker can bypass route-level authentication controls — including BasicAuth, DigestAuth, and ForwardAuth — and access protected backend endpoints without credentials. The impact is primarily on the subsequent (backend) system, with high confidentiality and integrity impact: attackers may read sensitive or administrative data, invoke privileged state-changing endpoints (via any HTTP method), and cross intended public/protected path boundaries. Availability is not directly affected, but the bypass is method-agnostic, meaning write operations against protected APIs are equally exploitable (Traefik Advisory, GitHub Advisory).

1. Reconnaissance: Identify Traefik instances (v3.7.0–v3.7.7) using the Kubernetes Ingress NGINX provider, e.g., via Shodan, Censys, or by inspecting Kubernetes Ingress annotations for nginx.ingress.kubernetes.io/rewrite-target.
2. Identify vulnerable routing pattern: Confirm that a public Ingress uses a regex path such as /api(.*) with a rewrite target of /$1 — a pattern that captures attacker-controlled text without requiring a path separator.
3. Identify protected endpoint: Determine a protected path (e.g., /admin) on the same backend that is secured via a separate Traefik router with BasicAuth, DigestAuth, or ForwardAuth.
4. Craft traversal request: Send a request to the public router path with a dot-segment traversal payload, e.g.:

   curl --path-as-is -i http://<target>/api../admin

   or using percent-encoding:

   curl --path-as-is -i http://<target>/api%2e%2e/admin

5. Bypass authentication: The public router matches /api../admin, the RewriteTarget middleware rewrites it to /../admin, and the backend normalizes this to /admin, returning protected content with HTTP 200 — bypassing the authentication middleware entirely (Traefik Advisory).

• Network: Unusual HTTP requests to public API paths containing .. or percent-encoded dot sequences (e.g., /api../, /api%2e%2e/) targeting paths that correspond to known protected endpoints; unexpected successful (HTTP 200) responses to paths that should return 401/403.
• Logs: Traefik access logs showing requests with raw paths like /api../admin or /api%2e%2e/admin resulting in 200 status codes; backend access logs showing requests arriving with raw path /../admin or similar dot-segment paths.
• Application Behavior: Successful access to administrative or protected API endpoints without corresponding authentication log entries (e.g., no BasicAuth credential validation events); anomalous read or write operations on protected resources from unauthenticated sessions (Traefik Advisory).

Primary remediation: Upgrade Traefik to v3.7.8 or later, which applies the same post-rewrite normalization invariant (using req.URL.JoinPath() and returning HTTP 400 when normalization changes the path) to the RewriteTarget middleware (Traefik Advisory, GitHub Advisory).

Temporary workaround: Modify the Ingress regex to require a path separator or end-of-path before the captured group, preventing ../ from matching:

nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/rewrite-target: "/$2"
# path: /api(/|$)(.*)

Additionally, enforce authentication at the backend application layer rather than relying solely on Traefik route-level middleware. Note that entryPoints.http.sanitizePath=true does not mitigate this issue, as sanitization occurs before routing and before RewriteTarget creates the traversal sequence.

The vulnerability was reported by researcher B1gN0Se, who provided a detailed proof-of-concept and remediation guidance in the Traefik security advisory. The Traefik maintainer kevinpollet published the advisory (GHSA-8rxv-jg7p-wvg3) on July 16, 2026, and the fix was released in v3.7.8. VulnCheck independently documented the issue in their advisory database (VulnCheck Advisory). No significant broader media coverage or social media discussion beyond standard CVE tracking feeds has been observed (Traefik Advisory).