CyberRota Analysis
AI-GeneratedTraefik versions up to v2.11.51, v3.6.0 to v3.6.22, and v3.7.0 to v3.7.6 are vulnerable to an authentication bypass due to improper handling of user-controlled path segments in the ReplacePathRegex middleware. This flaw allows unauthenticated remote attackers to craft requests that exploit path traversal, potentially accessing protected routes without proper authentication. Organizations using affected versions should prioritize patching to versions v2.11.52, v3.6.23, or v3.7.7 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.
Related CVEs
Other vulnerabilities affecting the same vendor(s)