CVE-2026-67309 traefik CVE debrief

Who should care

Traefik users, administrators of Kubernetes Ingress NGINX, and security teams responsible for patching and vulnerability management should prioritize patching to prevent potential authentication bypass attacks. They should review and update Ingress path configurations to prevent regex capture of attacker-controlled text and implement additional authentication and authorization controls for sensitive endpoints.

Technical summary

The RewriteTarget middleware in Traefik's Kubernetes Ingress NGINX provider is vulnerable to path traversal attacks. When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator, a crafted request can be rewritten to a dot-segment traversal path and forwarded without post-replacement normalization validation. This can result in route-level authentication bypass. The issue is fixed in v3.7.8.

Defensive priority

Traefik users should prioritize patching to prevent potential authentication bypass attacks.

Recommended defensive actions

• Patch Traefik to version 3.7.8 or later
• Review and update Ingress path configurations to prevent regex capture of attacker-controlled text
• Implement additional authentication and authorization controls for sensitive endpoints
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates a path traversal vulnerability in Traefik versions >= v3.7.0 and <= v3.7.7. The issue is fixed in v3.7.8. Limited information is available about affected scope and vendor remediation efforts. Traefik users should verify their deployments and review Ingress path configurations to prevent regex capture of attacker-controlled text. Defenders should check for exposures, review compensating controls, and monitor for suspicious activity.

Official resources