Log in Start free

Vulnerability · Published Apr 30, 2026 · Assigned by GitHub_M

CVE-2026-40912Traefik: StripPrefixRegex auth bypass via Path/RawPath desync

High 8.6

In plain English

A high-severity path traversal in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.8%top 44.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does not match the protected path patterns and therefore allows the request through. The backend then normalizes the dot-segment to the real path per RFC 3986 and serves the protected content An unauthenticated attacker can exploit this against any backend that performs dot-segment normalization. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/traefik/traefikno fix listedGHSA-6jwx-7vp4-9847
Gogithub.com/traefik/traefikno fix listedGO-2026-5180
Gogithub.com/traefik/traefik/v22.11.43GHSA-6jwx-7vp4-9847
Gogithub.com/traefik/traefik/v22.11.43GO-2026-5180
Gogithub.com/traefik/traefik/v33.7.0-rc.2GHSA-6jwx-7vp4-9847
Gogithub.com/traefik/traefik/v33.6.14, 3.7.0-rc.2GO-2026-5180
Gogithub.com/traefik/traefik/v33.6.14GHSA-6jwx-7vp4-9847

Affected products (as reported)

VendorProductVersions
traefik traefik < 2.11.43>= 3.0.0-beta1, < 3.6.14>= 3.7.0-ea.1, < 3.7.0-rc.2

Weakness: CWE-706, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References