Database/Container, Kubernetes & orchestration

Traefik: rewrite-target path traversal bypasses authentication on protected routers

CVSS 7.8CVE-2026-67309Container, Kubernetes & orchestrationcurated

Impact

An unauthenticated request such as /api../admin matches a public Ingress whose regex captures attacker text without a path separator, gets rewritten to /../admin, and is forwarded without re-normalizing the result. A backend that resolves dot segments then serves an endpoint that was only supposed to be reachable through a separate router guarded by BasicAuth, DigestAuth or ForwardAuth. On a GPU cluster Traefik is frequently the single ingress in front of inference endpoints, notebook servers and internal admin UIs, so this turns the auth boundary between a public model endpoint and an internal control surface into a string-rewriting accident. Nothing in the fleet needs to be compromised first - the attacker only needs network access to the ingress.

Who can reach it

Anyone who can reach the Traefik ingress, including from the internet. No authentication required. Exposure depends on having an Ingress that uses nginx.ingress.kubernetes.io/rewrite-target with a capture group that does not require a path separator.

What to do

Upgrade Traefik to v3.7.8 and restart the ingress pods - a rolling restart of the Traefik deployment, no node drain or GPU workload impact. As an interim mitigation, tighten the affected Ingress regexes so the capture group requires a path separator (for example /api/(.*) instead of /api(.*)), and do not rely on router-level auth alone for endpoints the backend also exposes by normalized path.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-67309 https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3 https://github.com/traefik/traefik/commit/69259c3acc9d4bdc065cb2e3b83336f7de3e7038 https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.