CVE-2026-65600

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65600", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-22T10:48:36.000Z", "datePublished": "2026-07-22T11:21:46.783Z", "dateUpdated": "2026-10-08T15:23:54.243Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:23:54.243Z"}, "datePublic": "2026-07-09T00:00:00.000Z", "title": "Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex", "descriptions": [{"lang": "en", "value": "Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex \"^/api(.*)\", replacement \"/$1\"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "traefik", "product": "traefik", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.11.52"}, {"version": "2.11.52", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "traefik", "product": "traefik", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "versions": [{"version": "3.6.0", "status": "affected", "versionType": "semver", "lessThan": "3.6.23"}, {"version": "3.6.23", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "traefik", "product": "traefik", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "versions": [{"version": "3.7.0", "status": "affected", "versionType": "semver", "lessThan": "3.7.7"}, {"version": "3.7.7", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.11.52"}, {"vulnerable": true, "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6.0", "versionEndExcluding": "3.6.23"}, {"vulnerable": true, "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7.0", "versionEndExcluding": "3.7.7"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv", "name": "GitHub Security Advisory (GHSA-cxjq-mrr5-89rv)", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex"}], "credits": [{"lang": "en", "value": "C-h4ck-0", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T19:08:10.643487Z", "id": "CVE-2026-65600", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T19:08:19.233Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65600", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T19:08:10.643487Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T19:08:15.372Z"}}], "cna": {"title": "Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex", "credits": [{"lang": "en", "type": "reporter", "value": "C-h4ck-0"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "traefik", "product": "traefik", "versions": [{"status": "affected", "version": "0", "lessThan": "2.11.52", "versionType": "semver"}, {"status": "unaffected", "version": "2.11.52", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "defaultStatus": "unaffected"}, {"vendor": "traefik", "product": "traefik", "versions": [{"status": "affected", "version": "3.6.0", "lessThan": "3.6.23", "versionType": "semver"}, {"status": "unaffected", "version": "3.6.23", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "defaultStatus": "unaffected"}, {"vendor": "traefik", "product": "traefik", "versions": [{"status": "affected", "version": "3.7.0", "lessThan": "3.7.7", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.7", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "defaultStatus": "unaffected"}], "datePublic": "2026-07-09T00:00:00.000Z", "references": [{"url": "https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv", "name": "GitHub Security Advisory (GHSA-cxjq-mrr5-89rv)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex", "name": "VulnCheck Advisory: Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex \"^/api(.*)\", replacement \"/$1\"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.11.52"}, {"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.6.23", "versionStartIncluding": "3.6.0"}, {"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.7.7", "versionStartIncluding": "3.7.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:23:54.243Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65600", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:23:54.243Z", "dateReserved": "2026-07-22T10:48:36.000Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-22T11:21:46.783Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "product": "traefik", "vendor": "traefik", "versions": [{"lessThan": "2.11.52", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.11.52", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "product": "traefik", "vendor": "traefik", "versions": [{"lessThan": "3.6.23", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.6.23", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "product": "traefik", "vendor": "traefik", "versions": [{"lessThan": "3.7.7", "status": "affected", "version": "3.7.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.7", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCFA016A-BDAB-4C4A-AFEB-2C7C877AE345", "versionEndExcluding": "2.11.52", "vulnerable": true}, {"criteria": "cpe:2.3:a:traefik:traefik:*:-:*:*:*:*:*:*", "matchCriteriaId": "99A7B51B-DB02-460E-A562-3738F7162E8F", "versionEndExcluding": "3.6.23", "versionStartIncluding": "3.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:traefik:traefik:*:-:*:*:*:*:*:*", "matchCriteriaId": "673F7CFF-74B0-4E26-A1BE-5F560C289D20", "versionEndExcluding": "3.7.7", "versionStartIncluding": "3.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex \"^/api(.*)\", replacement \"/$1\"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7."}, {"lang": "es", "value": "Las versiones de Traefik menor o igual a v2.11.51, >= v3.6.0 menor o igual a v3.6.22, y >= v3.7.0 menor o igual a v3.7.6 contienen una omisi\u00f3n de autenticaci\u00f3n a trav\u00e9s de salto de ruta en el middleware ReplacePathRegex. Cuando ReplacePathRegex est\u00e1 configurado con una expresi\u00f3n regular que captura segmentos de ruta controlados por el usuario sin un separador de ruta obligatorio (p. ej., expresi\u00f3n regular \"^/api(.*)\", reemplazo \"/$1\"), el middleware reenv\u00eda la ruta reemplazada al backend sin validar que coincide con su forma normalizada. Un atacante remoto no autenticado puede enviar una solicitud manipulada (p. ej., GET /api../admin) que produce una ruta no normalizada como /../admin, que un backend que normaliza rutas resuelve a una ruta protegida, omitiendo el middleware de autenticaci\u00f3n. Corregido en v2.11.52, v3.6.23, y v3.7.7."}], "id": "CVE-2026-65600", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65600", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T19:08:10.643487Z", "version": "2.0.3"}}]}, "published": "2026-07-22T12:18:20.297", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "traefik: Traefik: Authentication bypass via path traversal in ReplacePathRegex middleware", "id": "2506097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506097"}, "csaw": false, "cvss3": {"cvss3_base_score": "10.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Traefik. An unauthenticated remote attacker can bypass authentication due to a path traversal vulnerability in the ReplacePathRegex middleware. When this middleware is misconfigured, it forwards un-normalized paths, allowing a backend to resolve them to protected routes and grant unauthorized access. This bypass enables access to sensitive administrative interfaces."], "name": "CVE-2026-65600", "package_state": [{"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-07-22T11:21:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-65600\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65600\nhttps://github.com/traefik/traefik/pull/13466\nhttps://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv\nhttps://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex"], "statement": "This Critical flaw in Traefik's `ReplacePathRegex` middleware allows an unauthenticated remote attacker to bypass authentication. When the middleware is configured with a regex that captures user-controlled path segments without a mandatory path separator, it can forward un-normalized paths. This enables access to protected backend routes, including sensitive administrative interfaces, by resolving paths like `/../admin` after normalization. This poses a significant risk to the integrity and confidentiality of services exposed through Traefik in Red Hat OpenShift Dev Spaces deployments.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.11.52)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.7.0,3.7.7)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "traefik", "vendor": "traefik"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.11.52)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traefik", "source": "cna", "vendor": "traefik"}, "product": "traefik", "vendor": "traefik"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.23)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traefik", "source": "cna", "vendor": "traefik"}, "product": "traefik", "vendor": "traefik"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.7.0,3.7.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traefik", "source": "cna", "vendor": "traefik"}, "product": "traefik", "vendor": "traefik"}], "created": "2026-07-23T02:00:10.169726+00:00", "updated": "2026-08-04T00:00:09.755151+00:00", "vendors": ["traefik", "traefik$PRODUCT$traefik"]}