CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

What is CVE-2026-67309?

CVE-2026-67309 is a high-severity path traversal vulnerability in Traefik Traefik, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.

Weakness: CWE-22

Which versions are affected by CVE-2026-67309?

5 open source packages ship an affected version, including github.com/traefik/traefik/v3, github.com/traefik/traefik and github.com/traefik/traefik/v2. It affects 1 product.

Products include Traefik Traefik.

How do I fix CVE-2026-67309?

Upgrade github.com/traefik/traefik/v3 to 3.7.8 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-67309 being exploited?

There is no known exploitation of CVE-2026-67309 in the wild and no public exploit code.

Other vulnerabilities in Traefik Traefik

• CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik Critical 9.8
• CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect Critical 9.3
• CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth Critical 9.3
• CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse Critical 9.1
• CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging High 8.8

All Traefik Traefik vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8rxv-jg7p-wvg3, GO-2026-6207, MINI-3r4h-h443-cwh9, MINI-4jhf-4cgr-g787, MINI-chxf-hh25-j4q5.