Description
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
traefik traefik
Default version status: unaffected
3.7.0 to < 3.7.8affected3.7.8unaffected
pkg:golang/github.com/traefik/traefik/v3References
- https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3 ↗
- https://github.com/traefik/traefik/commit/b93f02cd07b79490fb8c8f02e301a7a1ec553195 ↗
- https://github.com/traefik/traefik/commit/69259c3acc9d4bdc065cb2e3b83336f7de3e7038 ↗
- https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass ↗