🚨High - Traefik Authentication Bypass via ReplacePathRegex Path Traversal (CVE-2026-65600) Traefik's ReplacePathRegex middleware, when configured with a regex that captures user-controlled path segments without a mandatory separator (e.g. ^/api(.*) → /$1), forwards the rewritten path to the backend without checking it against its normalized form. An unauthenticated attacker can send a crafted request like GET /api../admin, producing an unnormalized path such as /../admin. A backend that normalizes paths resolves it to a protected route, bypassing the authentication middleware in front of it. CVSS 7.8. 👉Upgrade Traefik to 2.11.52, 3.6.23, or 3.7.7 depending on your branch, and review ReplacePathRegex rules that capture path segments without a separator.
Post summary
The post discloses a high‑severity authentication bypass flaw in Traefik’s ReplacePathRegex middleware, details its exploitation path, and recommends patching to mitigate the issue.
