Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Kubernetes Traefik Path Traversal Allows Authentication Bypass
published 3 months ago
Summary
A bug in Traefik versions 3.7.0 to 3.7.7 allows attackers to bypass authentication on certain routes. This is fixed in version 3.7.8. Users should update to the latest version to prevent this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | traefik | >= 3.7.0, <= 3.7.7 |
Original advisory text
Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references.
## Original Description
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.
This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references.
## Original Description
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.
References
- https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3
- https://nvd.nist.gov/vuln/detail/CVE-2026-67309
- https://github.com/traefik/traefik/commit/69259c3acc9d4bdc065cb2e3b83336f7de3e70...
- https://github.com/traefik/traefik/commit/b93f02cd07b79490fb8c8f02e301a7a1ec5531...
- https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-au...
- https://github.com/advisories/GHSA-7qf5-7ppr-87v8
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-22Path Traversal
Timeline
Published1 Aug 2026
Updated6 Aug 2026
First seen6 Aug 2026
Sources
GHSA-7qf5-7ppr-87v8 · GHSA
Track software like this
Free during beta