CVE-2026-48020: Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

Synopsis

An authentication bypass vulnerability exists in Traefik's StripPrefix middleware, affecting versions prior to 2.11.48, 3.6.19, and 3.7.3. The flaw is reachable over the network without any credentials: an attacker sends a crafted HTTP request whose path contains dot-dot segments (.. or %2e%2e) that match a public route at routing time, then normalize after prefix-stripping to resolve against a separately authenticated route. Successful exploitation grants the attacker full read and write access to protected backend paths such as admin or internal configuration endpoints, without satisfying any authentication middleware. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream fix versions are published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Traefik instance over the network; the service's HTTP listener must be reachable from the attacker's origin.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerability is exploitable by any unauthenticated HTTP client.

• Victim interactionNot required

  No victim action is needed; the attacker sends a crafted request directly to the Traefik endpoint without any user involvement.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker only needs to craft a path containing dot-dot segments, with no race conditions or environmental prerequisites.

Blast Radius

• Reads protected backend resources such as admin dashboards, internal configuration endpoints, and management APIs without credentials.
• Writes to or modifies protected backend resources, enabling configuration tampering or administrative actions on the backend service.
• Bypasses any route-level authorization controls (token validation, OAuth middleware, basic-auth) attached to the protected Traefik router.
• Exposes all backend services routed through the affected Traefik instance that rely on StripPrefix-plus-router separation for access control.