Path traversal in Traefik - CVE-2026-67309
Published: August 21, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass route-level authentication or authorization and access protected backend paths.
The vulnerability exists due to path traversal in the RewriteTarget middleware of the Kubernetes Ingress NGINX provider when processing requests that use a rewrite-target regex capturing attacker-controlled path content without a required path separator. A remote attacker can send a specially crafted request to bypass route-level authentication or authorization and access protected backend paths.
Exploitation requires the Kubernetes Ingress NGINX provider to be enabled, a public Ingress to use a vulnerable rewrite-target regex pattern, and the backend to normalize dot segments before request dispatch.