Traefik Authentication Bypass via ReplacePathRegex Path Traversal (CVE-2026-65600)

What happened

Traefik has disclosed a critical authentication-bypass vulnerability (CVE-2026-65600, CVSS 9.1) affecting the ReplacePathRegex middleware in Traefik v2 and v3. Per the GitHub Security Advisory, when this middleware is configured with a regex that captures a user-controlled path segment without a mandatory separator (e.g. regex: "^/api(.*)", replacement: "/$1"), an attacker can send a crafted request such as GET /api../admin that Traefik forwards to the backend as an un-normalized path (/../admin) without validation. A backend that normalizes paths (Express, Flask, Django, Spring, ASP.NET, per the advisory's PoC) can resolve this to a protected route, letting an unauthenticated attacker reach content that sits behind a separate auth-enforcing router. The advisory notes this is the same class of bug fixed for StripPrefix under CVE-2026-48020, but the equivalent post-replacement normalization check was never applied to ReplacePathRegex. A public PoC using a Docker Compose lab is included in the advisory. Fixes are published in v2.11.52, v3.6.23, and v3.7.7.

Why it matters

Traefik is widely used as an edge reverse proxy/ingress controller in containerized and Kubernetes environments, often specifically to centralize authentication (BasicAuth, DigestAuth, ForwardAuth) in front of otherwise-unauthenticated backend services. The vulnerable pattern — using ReplacePathRegex as a prefix-stripping equivalent to StripPrefix — is described by the advisory as a common, documented configuration. Both read and write requests (GET/POST/PUT/DELETE) can bypass auth with a single crafted HTTP request from an unauthenticated network attacker, making this a straightforward path to admin panels, internal APIs, or other sensitive routes wherever this middleware pattern is in use.

What defenders should do now

• Inventory Traefik dynamic configuration for any replacePathRegex middleware whose regex captures a path segment without a mandatory / separator before the capture group (e.g. ^/api(.*) rather than ^/api/(.*)) — this is the exploitable form.
• Prioritize upgrading Traefik to v2.11.52, v3.6.23, or v3.7.7, especially on instances where ReplacePathRegex is paired with a separately-routed auth middleware (BasicAuth/DigestAuth/ForwardAuth) on protected paths.
• Until patched, consider reviewing whether affected routers can be temporarily switched to StripPrefix (already fixed for this class of issue) or a regex with an explicit separator.
• For hunting/detection, look for inbound requests containing literal or encoded dot-segment sequences appended to path prefixes handled by rewrite middlewares (e.g. /api../, /api%2e%2e/), and correlate access to normally auth-gated backend routes with requests that lack corresponding auth-middleware log entries or 401 responses.
• Confirm at the backend layer whether path normalization is masking traversal — defense in depth here (backend-side auth checks, not just edge auth) reduces exposure to this entire bug class.

This is a same-day advisory and details may evolve as the community and vendor share further guidance; treat the above as initial hunting and mitigation angles rather than a final playbook. For the full technical writeup, proof-of-concept, and patch links, see the original GitHub Security Advisory: GHSA-cxjq-mrr5-89rv.