Traefik StripPrefix Auth Bypass <2.11.48 /3.6.19 (Unauth)
CVE-2026-48020 Published on June 23, 2026
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths such as admin or internal configuration endpoints without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.
Vulnerability Analysis
CVE-2026-48020 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Types
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-48020 has been classified to as a Directory traversal vulnerability or weakness.
Products Associated with CVE-2026-48020
stack.watch emails you whenever new vulnerabilities are published in Traefik or Red Hat Openshift Devspaces. Just hit a watch button to start following.
Affected Versions
traefik:- Version >= 3.7.0-ea.1, < 3.7.3 is affected.
- Version >= 3.0.0-beta1, < 3.6.19 is affected.
- Version < 2.11.48 is affected.