{"cvss":7.8,"datePublished":"2026-10-21T00:00:00Z","dateUpdated":"2026-10-21T00:00:00Z","description":"Traefik versions = v3.6.0 = v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex \"^/api(.*)\", replacement \"/$1\"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.","dueDate":"","id":"CVE-2026-65600","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"traefik","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"traefik traefik Improper Limitation of a Pathname to a Restricted Directory","vendor":"traefik"}