EUVD-2026-51815
GHSA-7qf5-7ppr-87v8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, unauthenticated with scope change to backend; high C/I because authentication bypass exposes protected backend endpoints; A:N as no availability impact is described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.
AnalysisAI
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.
Technical ContextAI
Traefik is a cloud-native reverse proxy and load balancer that integrates natively with Kubernetes. The Kubernetes Ingress NGINX provider translates nginx.ingress.kubernetes.io/rewrite-target annotations into Traefik RewriteTarget middleware rules. When the Ingress path uses a capturing regex group (e.g., /api(.*)) and the rewrite target references the capture (/$1), Traefik performs string substitution but does not apply RFC 3986 dot-segment normalization to the resulting path before forwarding the request to the upstream backend. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes this class of flaw: user-controlled input influences path construction in a way that escapes the intended scope. Affected product is identified by CPE cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* for the 3.7.0-3.7.7 range. The vulnerability manifests only when the NGINX Ingress provider is in use, not the standard Traefik Kubernetes provider.
RemediationAI
Vendor-released patch: v3.7.8. Upgrade Traefik to version 3.7.8 or later, which contains the upstream fix implemented across two commits: b93f02cd07b79490fb8c8f02e301a7a1ec553195 and 69259c3acc9d4bdc065cb2e3b83336f7de3e7038, both available in the Traefik GitHub repository. For teams unable to upgrade immediately, audit all Ingress resources using the nginx.ingress.kubernetes.io/rewrite-target annotation and replace open-ended capture groups (e.g., (.*)) with patterns that explicitly require a leading path separator (e.g., (/|$)(.*)), preventing dot-segment injection into the rewritten path; note this changes routing behavior and requires per-application testing before deployment. As a structural mitigation, ensure that sensitive backend paths protected by BasicAuth, DigestAuth, or ForwardAuth are served by backend services entirely separate from those reachable via regex rewrite Ingress rules, eliminating the shared path namespace that the bypass exploits. Vendor advisory: https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today