Technical impact
Traefik versions 3.7.0 through 3.7.7 contain a path‑traversal flaw (CWE-22) in the Kubernetes Ingress NGINX provider’s RewriteTarget middleware. When an Ingress path regex captures user‑controlled text without a path separator, a request such as /api../admin rewrites to /../admin, a dot‑segment that is later resolved by the backend to a protected endpoint that normally requires authentication. The attacker can therefore access sensitive routes that are normally protected by BasicAuth, DigestAuth or ForwardAuth, leaking confidential data and potentially allowing further compromise.
Affected Systems
All installations of Traefik v3.7.0 to v3.7.7 that use the nginx.ingress.kubernetes.io/rewrite-target annotation in a Kubernetes Ingress resource are affected. The vulnerability is tied specifically to the RewriteTarget middleware in the NGINX provider of Traefik; systems that do not use the rewrite‑target annotation or use a different provider are not impacted.
Risk and Exploitability
The CVSS score of 7.8 classifies the vulnerability as high severity. No EPSS score is available, indicating no publicly disclosed exploit data at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered with a crafted HTTP request to a public router, the attack vector is remote; an attacker needs only to send a request that matches a vulnerable regex and can then bypass authentication to reach protected endpoints, achieving confidentiality and integrity impact.
Github GHSA