Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M

CVE-2026-48020Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

Critical 9.1

In plain English

A critical-severity authentication bypass in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.8%top 44.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/traefik/traefik	no fix listed	GO-2026-5752
Go	github.com/traefik/traefik/v2	2.11.48	GHSA-xf64-8mw2-4gr2
Go	github.com/traefik/traefik/v2	2.11.48	GO-2026-5752
Go	github.com/traefik/traefik/v3	3.6.19	GHSA-xf64-8mw2-4gr2
Go	github.com/traefik/traefik/v3	3.7.3	GHSA-xf64-8mw2-4gr2
Go	github.com/traefik/traefik/v3	3.6.19, 3.7.3	GO-2026-5752

Affected products (as reported)

Vendor	Product	Versions
traefik	traefik	>= 3.7.0-ea.1, < 3.7.3>= 3.0.0-beta1, < 3.6.19< 2.11.48

Weakness: CWE-288, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/traefik/traefik/security/advisories/GHSA-xf64-8mw2-4gr2 x_refsource_CONFIRM
https://github.com/traefik/traefik/releases/tag/v2.11.48 x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.6.19 x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.7.3 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-48020 vdb-entry, x_refsource_REDHAT
RHBZ#2491915 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48020.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:62260 vendor-advisory, x_refsource_REDHAT