CVE-2026-65600: Authentication Bypass via Path Traversal in Traefik ReplacePathRegex Middleware

Traefik is a modern reverse proxy and ingress controller designed to route incoming network requests to appropriate backend services. Within its routing architecture, Traefik employs various middleware components to inspect, modify, or restrict HTTP requests. The ReplacePathRegex middleware is specifically used to modify request paths using regular expressions prior to proxying.

The vulnerability is classified as improper limitation of a pathname to a restricted directory, or path traversal (CWE-22). The attack surface resides in endpoints configured with this middleware where the regular expression allows loose, non-delimited path capture. Remote, unauthenticated attackers can manipulate the requested path using directory traversal sequences to bypass proxy-level authorization.

By leveraging this flaw, attackers target routes configured with ReplacePathRegex to proxy modified paths to backend applications. If downstream backends perform automatic normalization, they resolve the traversal operators, granting unauthorized access to administrative or restricted handlers. Gateway-enforced authentication policies, such as OAuth2, Basic Auth, or Custom forward authentication, are rendered completely ineffective.

The root cause of CVE-2026-65600 lies in a parser differential vulnerability combined with a lack of validation after path replacement operations. The ReplacePathRegex middleware executes string substitution based on user-defined regular expression capture groups. However, prior to the fix, the middleware failed to validate or clean the rewritten path before transferring it to the proxy engine.

Consider an environment with a vulnerable regular expression configuration designed to match /api(.*). If an attacker requests /api../admin, the capture group (.*) evaluates to ../admin. The middleware substitutes this capture group into the replacement string, producing a modified path that contains active relative traversal sequences.

Traefik routes the request based on the initial matching logic, which deems /api../admin safe. The internal engine fails to clean the updated URI and forwards the raw traversal sequence to the backend. The downstream web framework (such as Node.js or Spring Boot) then normalizes the path to /admin, exposing the protected interface.

Analysis of the patch reveals the exact mechanism used to remediate the vulnerability. The security fix was committed to the Traefik repository within pkg/middlewares/replacepathregex/replace_path_regex.go in commit 3f10dd442479530560f010167cac2947676d9b29 by developer Kevin Pollet.

The modified codebase implements post-replacement normalization and comparison checks:

// pkg/middlewares/replacepathregex/replace_path_regex.go
 
func (rp *replacePathRegex) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
    // ... (replacement execution logic is performed here)
 
    req.RequestURI = req.URL.RequestURI()
 
    // The fix introduces sanitization and comparison verification
    path := req.URL.Path
    if path != "" {
        // JoinPath normalizes the path by resolving dot segments (path.Clean)
        req.URL = req.URL.JoinPath()
    }
 
    // If the cleaned path differs from the replaced path, block execution
    if path != req.URL.Path {
        logger.Debugf("Rejecting request, sanitized path: %q is not equivalent to stripped path: %q", path, req.URL.Path)
        http.Error(rw, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
        return
    }
}

This implementation utilizes Go's standard library JoinPath() to clean the output path. If the resulting cleaned path differs from the initial un-normalized replacement output, it indicates path traversal manipulation. Traefik logs the event, terminates the connection immediately, and responds with an HTTP 400 Bad Request error.

While the patch successfully stops standard path traversal vectors on UNIX platforms, security teams must monitor for parser discrepancies. Go's native path resolution does not treat backslashes as path separators on UNIX platforms, whereas specific Windows-based backend applications might execute backslash normalization, which represents a potential minor variant risk.

Exploitation requires no user interaction or existing privileges on the system. The attacker only needs network access to the exposed Traefik proxy and knowledge of a route employing the vulnerable middleware. Because path modification occurs invisibly, the downstream server receives and services the unauthorized traffic directly.

In a simulated attack, an operator identifies an API endpoint routed through Traefik with the rule regex: "^/public(.*)". The corresponding target backend hosts both public endpoints and an administrator console located at /secure-admin. Under normal operating parameters, Traefik blocks direct access to /secure-admin using an authentication middleware.

The attacker bypasses this control by transmitting a crafted GET request targeting /public/../../secure-admin. Traefik matches the request to the public rule, passes it through the replacement middleware, and rewrites the path. Since the original middleware failed to normalize the output, Traefik forwards the raw traversal sequence directly to the backend system.

The backend server receives /public/../../secure-admin and immediately normalizes the request to /secure-admin using its native routing rules. It processes the query and returns the sensitive data back to the proxy, bypassing the Traefik-layer authorization check entirely.

The security impact of CVE-2026-65600 is classified as high because it nullifies upstream perimeter security controls. Gateways are commonly utilized as centralized security boundaries to enforce authentication, rate limiting, and IP whitelisting. A bypass at this layer exposes entire backend architectures to unauthenticated remote actions.

According to the CVSS v4.0 assessment, this vulnerability receives a base score of 7.8, reflecting high subsequent confidentiality and integrity impacts. An attacker can access administrative APIs, extract confidential information from internal applications, or execute states-changing commands. The vulnerability does not require privileges, specialized system access, or user interaction.

Currently, the exploit status of this vulnerability remains at the proof-of-concept phase. There are no documented instances of weaponized exploitation in the wild, nor is the CVE listed in the CISA KEV catalog. Nevertheless, the ease of exploitation makes immediate remediation critical for organizations relying on Traefik gateways to secure backend services.

The recommended resolution is to upgrade all Traefik instances to the appropriate patched release. Administrators using the v2 branch must upgrade to at least v2.11.52. Organizations deploying v3.6 must migrate to v3.6.23 or later, and those on v3.7 must upgrade to at least v3.7.7.

If immediate software upgrades are not possible, administrators should apply defensive configuration adjustments. Inspect all dynamic configurations containing ReplacePathRegex middleware. Alter the matching regular expressions to enforce a strict slash delimiter, changing patterns like ^/api(.*) to ^/api/(.*) to reduce the traversal capture surface.

Organizations can also deploy external Web Application Firewall (WAF) rules to detect and drop directory traversal patterns within incoming request paths. In parallel, monitor system logs for HTTP 400 errors or requests featuring dot-dot-slash patterns. Upgrading remains the only complete and reliable remediation for the underlying flaw.