GHSA-CXJQ-MRR5-89RV Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Summary There is a critical authentication-bypass vulnerability in Traefik's ReplacePathRegex middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator for example regex: "^/api.", replacement: "/$1", a crafted request ca...

GHSA-RHG6-2VJH-J5QC Duplicate Advisory: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cxjq-mrr5-89rv. This link is maintained to preserve external references. Original Description Traefik versions = v3.6.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathReg...

CVE-2026-65600 Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex

Traefik versions = v3.6.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator e.g. regex "^/api.", replacement "/$1...

CVE-2026-65600 Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex

Traefik versions = v3.6.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator e.g. regex "^/api.", replacement "/$1...

PT-2026-63358

Traefik versions = v3.6.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator e.g. regex "^/api.", replacement "/$1...