Authentication Bypass Vulnerability in Traefik HTTP Reverse Proxy
CVE-2026-40912
7.8HIGH
What is CVE-2026-40912?
An authentication bypass vulnerability exists in Traefik's StripPrefixRegex middleware when used with ForwardAuth, BasicAuth, or DigestAuth. This issue allows unauthenticated attackers to exploit the application's handling of dot-segments in URLs. Specifically, the middleware improperly processes regex against the decoded URL path and uses the byte length of the raw path after modification. This allows attacker requests to bypass authentication checks, posing a risk of unauthorized access to protected content. The vulnerability has been successfully addressed in the latest software updates.
Affected Version(s)
traefik < 2.11.43 < 2.11.43
traefik >= 3.0.0-beta1, < 3.6.14 < 3.0.0-beta1, 3.6.14
traefik >= 3.7.0-ea.1, < 3.7.0-rc.2 < 3.7.0-ea.1, 3.7.0-rc.2