Advisory · CVE-2026-48020
Traefik path trick walks past route authentication
Traefik's StripPrefix middleware normalizes crafted paths after routing, letting unauthenticated requests reach backends that a separate router meant to protect.
- Vendor
- Traefik
- Product
- Traefik
- Identifier / CWE
- CVE-2026-48020
CWE-22, CWE-288 - Action timing
- Immediate
Explain it like I’m five
The doorman checks your ticket against the guest list, but if you write your name with a smudge he waves you through, and the smudge washes off inside to reveal a VIP name. You end up in the roped-off area without ever showing a real ticket.
- 01Public route matches
The attacker requests /api../admin, which matches a public router on PathPrefix(/api) with the StripPrefix middleware.
- 02Auth router skipped
The request never matches the protected router's PathPrefix(/admin) rule, so its authentication middleware never runs.
- 03Prefix stripped, path normalized
StripPrefix removes /api and the path is normalized, resolving to /admin.
- 04Protected backend reached
The backend receives /admin with no authentication applied, exposing admin or internal endpoints.
What happened
Traefik’s StripPrefix middleware contains a route-level authentication and authorization bypass (CWE-22, CWE-288). When a public router matches on a PathPrefix rule and applies StripPrefix, a request path containing .. or its percent-encoded form %2e%2e matches the public route at routing time; after the prefix is stripped and the path normalized, it resolves to a path served by a separate, authenticated router. The reporter’s proof of concept shows /api../admin and /api%2e%2e/admin reaching a protected backend as /admin with a 200 response, while direct requests to /admin are correctly rejected with 401. The flaw affects the StripPrefix middleware in the 2.11 and 3.6/3.7 lines and is fixed in 2.11.48, 3.6.19, and 3.7.3. NVD carries two CVSS 3.1 scores: 10.0 with scope changed and 9.1 with scope unchanged. There is no confirmed public exploitation at the time of writing.
What to do
- Upgrade to Traefik 2.11.48, 3.6.19, or 3.7.3 (matching your release line) or later.
- Audit every router that combines PathPrefix matching with StripPrefix alongside separately authenticated routers; that pairing is the vulnerable pattern.
- As defense in depth, prefer stricter route boundaries such as PathRegexp(
^/api(/|$)) or PathPrefix(/api/) paired with StripPrefix(/api/). - Review access logs for requests containing .. or %2e%2e segments that returned success against protected paths, and investigate any hits.
Management note
Reverse proxies are trust boundaries, and this bug quietly moves the boundary after the check has already happened. Any admin panel, internal API, or config endpoint sitting behind Traefik route authentication could have been reachable without credentials. The fix is a version bump, but the audit of which backends were exposed is the part that actually determines your risk.