Traefik, an open source HTTP reverse proxy, improperly handles rootless HTTP/1 request targets, storing them in URL.Opaque while leaving URL.Path empty. When the rewriteRequestBuilder normalizes the path to "/", it evaluates routing, path sanitization, forwardAuth, encodedCharacters, and access logging against this sanitized path but forwards the opaque target verbatim to the backend. This allows an attacker to send requests that bypass path‑scoped authorization, middleware guards, and access‑log generation, potentially exposing backend services and sensitive data.

All installations of Traefik prior to version 2.11.57 and 3.7.13 are vulnerable. This includes the traefik:traefik product across both major releases, regardless of operating environment. The issue remains until the corresponding patch version names are applied.

The CVSS score of 8.8 classifies the vulnerability as high severity, and the EPSS score is not available, indicating that no current exploit data is publicly reported. The vulnerability is not listed in CISA’s KEV. An attacker can exploit it remotely by sending a crafted HTTP/1 request with a rootless target to a Traefik instance; the request is routed to the backend without passing through normal routing or middleware checks. The resulting path‑bypass can be used for unauthorized access or to evade logging mechanisms, giving the attacker stealth and persistence. The lack of publicly known exploits does not diminish the risk, as the conditions required for exploitation are satisfied by any publicly reachable Traefik instance that accepts HTTP/1 requests.