CRITICAL 9.1 GitHub
CVE-2026-65600
Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
## Summary
There is a critical authentication-bypass vulnerability in Traefik's `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator (for example `regex: "^/api(.*)"`, `replacement: "/$1"`), a crafted request can produce an un-normalized replacement path such as `/../admin`, which Traefik forwarded to the backend without validation. A backend that normalizes the path may resolve it to a protected
Affected Products
- go/github.com/traefik/traefik/v2 <= 2.11.51
- go/github.com/traefik/traefik/v3 <= 3.6.22
- go/github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.6
- go/github.com/traefik/traefik <= 1.7.34
References
- https://github.com/advisories/GHSA-cxjq-mrr5-89rv
- https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv
- https://nvd.nist.gov/vuln/detail/CVE-2026-65600
- https://github.com/traefik/traefik/commit/3f10dd442479530560f010167cac2947676d9b29
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-08-06 via GitHub. Affected: go/github.com/traefik/traefik/v2 <= 2.11.51, go/github.com/traefik/traefik/v3 <= 3.6.22, go/github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.6 and 1 more.
Risk Timeline
CVE Disclosed2026-08-06 · 0 days ago
Remediation Resources
vulnfeed aggregates 9207 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.