Which versions of Traefik are affected by CVE-2026-65600?

Traefik reverse proxy versions 2.11.51 and earlier, 3.6.0-3.6.22, and 3.7.0-3.7.6 contain an authentication bypass vulnerability (CVE-2026-65600) that allows unauthenticated attackers to reach…. A patch is available.

Is there a public PoC exploit available for CVE-2026-65600?

Yes, a public proof-of-concept exploit is available for CVE-2026-65600. Prioritise patching immediately. EPSS: 1.0%.

How to fix or mitigate CVE-2026-65600?

Within 24 hours, identify and document all Traefik deployments in use across infrastructure, specifically cataloging which versions are running to determine exposure scope. Within 7 days, implement compensating controls including Web Application Firewall (WAF) rules to block path traversal sequences ('/../' patterns), network segmentation to restrict unauthenticated access to protected backend services, and enhanced logging on all protected endpoints to detect exploitation attempts. Within 30 days, establish monitoring of Traefik vendor security advisories; upon patch availability, schedule immediate testing and deploy the patched Traefik version (vendors typically release as 2.12.0+, 3.6.23+, or 3.7.7+, pending official release).

Traefik CVE-2026-65600

Q: What is the CVSS score of CVE-2026-65600?

CVE-2026-65600 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-47644 HIGH

Path Traversal (CWE-22)

2026-07-22 VulnCheck

GHSA-cxjq-mrr5-89rv

GHSA-rhg6-2vjh-j5qc

Authentication Bypass Path Traversal Traefik

7.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Remote unauthenticated single-request bypass (AV:N/AC:L/PR:N/UI:N); the proxy grants access to a protected backend, a scope change (S:C) with high confidentiality and integrity impact on that backend and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Red Hat

10.0 CRITICAL

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 13:02 EUVD

Analysis Generated

Jul 22, 2026 - 12:22 vuln.today

CVE Published

Jul 22, 2026 - 11:21 cve.org

HIGH 7.8

DescriptionCVE.org

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.

AnalysisAI

Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unauthenticated remote attackers to reach protected backend routes by abusing the ReplacePathRegex middleware. When the middleware rewrites a path using a capture group lacking a mandatory separator, a crafted request such as GET /api../admin yields an un-normalized path (/../admin) that the middleware forwards without re-validation; a normalizing backend then resolves it to a protected route, skipping any auth middleware bound to that path. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied, but the flaw is trivially reproducible from the advisory's own example.

Technical ContextAI

Traefik is a widely deployed cloud-native edge router / reverse proxy and Kubernetes ingress controller that routes HTTP traffic to backends and applies middleware chains (auth, rate-limiting, path rewriting). The affected component is the ReplacePathRegex middleware, which rewrites request paths using a Go regular expression and replacement template. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the middleware trusts the regex output and forwards the rewritten path without verifying it equals its own normalized form. A capture like regex "^/api(.*)" with replacement "/$1" pulls user-controlled bytes (including ../ sequences) directly into the outbound path. Because path normalization semantics differ between Traefik and the upstream backend, the mismatch is what enables traversal past routing/authorization boundaries defined earlier in the chain.

RemediationAI

Vendor-released patches are available: upgrade to Traefik v2.11.52, v3.6.23, or v3.7.7 depending on your branch, as documented in advisory GHSA-cxjq-mrr5-89rv (https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv). If immediate patching is not possible, audit all ReplacePathRegex middleware definitions and rewrite any rule whose capture group can absorb path bytes without a mandatory separator - for example anchor the regex to require a slash ("^/api/(.*)" with replacement "/$1") so ../ cannot be injected into the rewritten segment, accepting that this changes matching for requests to bare /api. As a compensating control, place authorization/authentication enforcement on the backend against the fully normalized path rather than relying on Traefik path-based routing, and/or add a WAF or rule to reject requests containing dot-dot sequences (e.g. ../ or encoded variants) before they reach the rewrite middleware, noting this may break legitimate paths that contain literal dot sequences. These mitigations reduce but do not fully replace the upstream fix.