Path Traversal Vulnerability in Traefik's Kubernetes Ingress NGINX Provider

CVE-2026-67309

What is CVE-2026-67309?

Traefik versions from v3.7.0 to v3.7.7 exhibit a path traversal vulnerability within the Kubernetes Ingress NGINX provider's RewriteTarget middleware. This issue arises when an Ingress path employs a regex that captures attacker-controlled segments of text without mandating a path separator. For example, a crafted request like /api../admin can exploit the vulnerability. The crafted request is matched by the public router, which rewrites it to a dot-segment traversal path (/../admin) and forwards it without proper validation. If the backend normalizes dot segments, it improperly resolves the path to sensitive endpoints like /admin, potentially bypassing authentication protocols such as BasicAuth or DigestAuth. The issue has been resolved in version v3.7.8.

References