Traefik CVE-2026-65600

Exploitation requires that the target Traefik deployment has a ReplacePathRegex middleware configured with a regex that captures user-controlled path segments without a mandatory path separator (the advisory's example: regex "^/api(.*)", replacement "/$1"), AND a backend behind it that normalizes paths (resolving /../ sequences) and hosts a protected route reachable via traversal. Given those, exploitation is remote and unauthenticated (PR:N/UI:N) with low complexity - a single crafted GET request. Limiting factors: deployments that do not use ReplacePathRegex, or that use it with a properly anchored separator (e.g. "^/api/(.*)"), are not exploitable, and backends that reject un-normalized paths (return the request untouched or 400 on /../ ) neutralize the bypass; affected only in Traefik <= v2.11.51, v3.6.0-v3.6.22, and v3.7.0-v3.7.6.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:N/VA:N, SC:H/SI:H/SA:N, base 7.8) is internally consistent with an unauthenticated, network-reachable, low-complexity bypass whose damage lands on the subsequent system (the protected backend) rather than on Traefik itself - hence the vulnerable-system impacts are N while subsequent-system confidentiality and integrity are High. Real-world risk hinges on a specific configuration prerequisite: an exploitable ReplacePathRegex rule, so this is not a blanket 'every Traefik is exploitable' issue. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input; however, the advisory publishes a working request pattern, meaning weaponization is low-effort for any attacker who identifies a vulnerable rule. Bottom line: for environments that use ReplacePathRegex in front of authenticated backends this is a high-priority patch; for those that do not, exposure is limited despite the high base score.

An attacker fingerprints an application fronted by Traefik and discovers a route rewritten by ReplacePathRegex (e.g. a public /api/* prefix mapped onto a backend). They send GET /api../admin, causing the middleware to emit /../admin, which the backend normalizes to /admin and serves without the authentication that Traefik would have enforced on the real /admin route. No credentials, user interaction, or special access are needed, and the advisory's published example makes the request pattern immediately reproducible.