CyberRota Analysis
AI-GeneratedVersions of Traefik from 3.7.0 to 3.7.7 are vulnerable to a path traversal flaw in the Kubernetes Ingress NGINX provider's RewriteTarget middleware, allowing attackers to craft requests that bypass authentication to access protected endpoints. This vulnerability arises when regex patterns capture user-controlled input without enforcing path separators, enabling unauthorized access to sensitive routes. Organizations using affected Traefik versions in conjunction with Nginx or Kubernetes should prioritize upgrading to version 3.7.8 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.