Traefik's StripPrefixRegex middleware incorrectly slices the percent-encoded raw path based on the decoded path length. When a prefix contains one or more dots, the resulting stripped raw path becomes a dot‑segment such as "/./admin/secret". Forward authentication mechanisms receive this dot‑segment in the X‑Forwarded‑Uri header, which does not match the intended protected path patterns, allowing the request to pass through the authentication layer. The backend then normalizes the dot‑segment to the real path and serves protected content to an unauthenticated attacker. This is an authentication bypass via a path desynchronization flaw (CWE‑706).

The vulnerability affects Traefik versions older than 2.11.43, 3.6.14, and 3.7.0‑rc.2. Any deployment that uses the StripPrefixRegex middleware together with ForwardAuth, BasicAuth, or DigestAuth is at risk. Systems running Traefik 2.x or 3.x prior to the patched releases are vulnerable.

The CVSS score is 7.8, indicating high severity, while the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by crafting an HTTP request with a dot‑segment in the prefix of the URL, a technique that requires network access to the Traefik instance. If the backend normalizes dot‑segments (as required by RFC 3986), the protected resources are returned without authentication.