Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does not match the protected path patterns and therefore allows the request through. The backend then normalizes the dot-segment to the real path per RFC 3986 and serves the protected content An unauthenticated attacker can exploit this against any backend that performs dot-segment normalization. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-30 | 1 | Patch1 |
| 2026-05-01 | 3 | Disclosure2General1 |
CVE-2026-40912 Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in… https://www.cve.org/CVERecord?id=CVE-2026-40912
Post summary
CVE‑2026‑40912 is an authentication bypass in Traefik; older releases are vulnerable, while newer versions (2.11.43, 3.6.14, 3.7.0‑rc.2+) contain the fix.
CVE-2026-40912: Traefik Auth Bypass Flaw Exposes Protected APIs https://thecybrdef.com/cve-2026-40912-traefik-auth-bypass-flaw-exposes-protected-apis/ #CVE202640912 #Traefik #AuthBypass #CyberSecurity #APIsecurity #VulnerabilityAlert #SecurityFlaw #ZeroTrust #InfoSec #CloudSecurity #DevSecOps #CyberThreat #PatchNow #SecurityUpdate
Post summary
The article announces an auth bypass flaw in Traefik, CVE‑2026‑40912, that exposes protected APIs. No PoC, exploit code, active exploitation, or patch information is provided in the text.
CVE-2026-40912: Traefik Auth Bypass Flaw Exposes Protected APIs https://thecybrdef.com/cve-2026-40912-traefik-auth-bypass-flaw-exposes-protected-apis/ #CVE202640912 #Traefik #AuthBypass #CyberSecurity #APIsecurity #VulnerabilityAlert #SecurityFlaw #ZeroTrust #InfoSec #CloudSecurity #DevSecOps #CyberThreat #PatchNow #SecurityUpdate
Post summary
The post announces CVE‑2026‑40912 as an auth‑bypass flaw in Traefik but provides no technical details, PoC, exploit code, or evidence of active exploitation or patch information.
CVE-2026-40912 Authentication Bypass in Traefik StripPrefixRegex Middleware Prior to 2.11.43 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40912
Post summary
The text announces CVE-2026-40912, an authentication bypass in Traefik’s StripPrefixRegex Middleware before version 2.11.43, without providing an exploit, patch, or additional technical details beyond the basic description.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | traefik | traefik | - | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |