Traefik CVE-2026-67309

Exploitation requires all of the following conditions to be simultaneously true: (1) Traefik is operating as a Kubernetes Ingress controller using the Kubernetes Ingress NGINX provider specifically (not the standard Kubernetes Traefik provider); (2) at least one Ingress resource carries a nginx.ingress.kubernetes.io/rewrite-target annotation with a regex capture group that does not mandate a path separator character in the captured segment - for example, path /api(.*) with rewrite target /$1 is vulnerable, while /api(/|$)(.*) with rewrite /$2 is not; (3) the backend application performs dot-segment normalization when resolving the forwarded path; and (4) a protected endpoint (e.g., /admin) exists on the same backend, secured at the Traefik router level via BasicAuth, DigestAuth, or ForwardAuth on a separate Ingress/router. Authentication to Traefik is not required (PR:N per CVSS 4.0 vector). Exploitation is limited to Traefik versions 3.7.0-3.7.7. Deployments where no sensitive routes share a backend with regex-rewrite public routes have no exploitable impact even if the configuration is present.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-exploitable, low-complexity, unauthenticated exploitation with no special attack requirements, scoring 7.8 (High). Impact is entirely on subsequent systems (SC:H/SI:H) rather than Traefik itself (VC:N/VI:N/VA:N), reflecting the scope-change nature of the bypass: Traefik is the vulnerable component but the backend application is what suffers confidentiality and integrity compromise. No EPSS score was provided in available intelligence, and the vulnerability is not listed in the CISA KEV catalog at time of analysis, indicating no confirmed active exploitation. No public proof-of-concept code has been referenced. Despite the absence of KEV or POC signals, the attack is conceptually trivial - requiring only a standard HTTP client and knowledge of the target's Ingress configuration - and the authentication bypass impact is high-value. The primary real-world limitation is the specific deployment condition: the NGINX Ingress provider must be in use with an open-ended capture regex on a rewrite-target route co-existing with a separately-authenticated route on the same backend path space. Organizations using the default Kubernetes Traefik provider or non-regex Ingress paths are not affected.

An attacker enumerates a Kubernetes cluster's publicly-exposed Traefik Ingress and identifies an endpoint such as /api mapped with a regex rewrite rule (/api(.*) → /$1). The attacker sends GET /api../admin to Traefik; the RewriteTarget middleware rewrites the path to /../admin and forwards it to the backend without normalization. The backend's HTTP stack resolves the dot-segment path to /admin - a route protected by BasicAuth on a separate Traefik router - and serves the response, bypassing authentication entirely. No public exploit code has been identified at time of analysis, but the technique requires only a standard HTTP request.