{"id":"CVE-2026-65600","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-07-22T12:18:20.297","lastModified":"2026-10-24T13:10:00.147","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex \"^/api(.*)\", replacement \"/$1\"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7."},{"lang":"es","value":"Las versiones de Traefik menor o igual a v2.11.51, >= v3.6.0 menor o igual a v3.6.22, y >= v3.7.0 menor o igual a v3.7.6 contienen una omisión de autenticación a través de salto de ruta en el middleware ReplacePathRegex. Cuando ReplacePathRegex está configurado con una expresión regular que captura segmentos de ruta controlados por el usuario sin un separador de ruta obligatorio (p. ej., expresión regular \"^/api(.*)\", reemplazo \"/$1\"), el middleware reenvía la ruta reemplazada al backend sin validar que coincide con su forma normalizada. Un atacante remoto no autenticado puede enviar una solicitud manipulada (p. ej., GET /api../admin) que produce una ruta no normalizada como /../admin, que un backend que normaliza rutas resuelve a una ruta protegida, omitiendo el middleware de autenticación. Corregido en v2.11.52, v3.6.23, y v3.7.7."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"traefik","product":"traefik","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/traefik/traefik/v2","versions":[{"version":"0","lessThan":"2.11.52","versionType":"semver","status":"affected"},{"version":"2.11.52","versionType":"semver","status":"unaffected"}]},{"vendor":"traefik","product":"traefik","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/traefik/traefik/v3","versions":[{"version":"3.6.0","lessThan":"3.6.23","versionType":"semver","status":"affected"},{"version":"3.6.23","versionType":"semver","status":"unaffected"}]},{"vendor":"traefik","product":"traefik","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/traefik/traefik/v3","versions":[{"version":"3.7.0","lessThan":"3.7.7","versionType":"semver","status":"affected"},{"version":"3.7.7","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-23T19:08:10.643487Z","id":"CVE-2026-65600","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","versionEndExcluding":"2.11.52","matchCriteriaId":"CCFA016A-BDAB-4C4A-AFEB-2C7C877AE345"},{"vulnerable":true,"criteria":"cpe:2.3:a:traefik:traefik:*:-:*:*:*:*:*:*","versionStartIncluding":"3.6.0","versionEndExcluding":"3.6.23","matchCriteriaId":"99A7B51B-DB02-460E-A562-3738F7162E8F"},{"vulnerable":true,"criteria":"cpe:2.3:a:traefik:traefik:*:-:*:*:*:*:*:*","versionStartIncluding":"3.7.0","versionEndExcluding":"3.7.7","matchCriteriaId":"673F7CFF-74B0-4E26-A1BE-5F560C289D20"}]}]}],"references":[{"url":"https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv","source":"disclosure@vulncheck.com","tags":["Patch","Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}