Traefik includes an authentication bypass in the ReplacePathRegex middleware. When the middleware receives a user‑controlled URL that matches a regular expression lacking a mandatory path separator—such as ^/api(.*)—the captured group is substituted into the backend URL without normalizing the path. A crafted request like GET /api../admin creates the string /../, which a backend that normalizes paths interprets as a protected admin route, thus allowing an unauthenticated attacker to reach a resource behind an authentication middleware. The flaw is based on unvalidated path traversal (CWE‑22) and can compromise confidentiality of resources protected by authentication.

Traefik versions up to v2.11.51, 3.6.0 through 3.6.22, and 3.7.0 through 3.7.6 are affected. Any deployment using these releases and employing the ReplacePathRegex middleware with a regex that captures user input without enforcing a path separator is vulnerable. All other Traefik versions are considered safe.

Security analysts rate the vulnerability with a CVSS score of 7.8, indicating high severity. The EPSS score of less than 1% suggests that while exploitation incidents are not overwhelmingly common, they are plausible, especially for publicly exposed Traefik services. The vulnerability is not listed in the CISA KEV catalog at present, reducing but not eliminating the risk of targeted exploitation. Attackers can carry out the exploit remotely by sending a crafted HTTP request to the vulnerable service; the bypass does not require authentication or privileged access. Once the request is processed, the unauthenticated attacker can access protected backend routes, potentially exposing sensitive data or system controls.