CVE-2026-48020

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.48 Traefik versions prior to 3.6.19 Traefik versions prior to 3.7.3

Description An unauthenticated attacker can bypass route-level authentication and authorization in Traefik when PathPrefix-based public routes are used in combination with the StripPrefix middleware. By using a request path containing .. or its percent-encoded form %2e%2e, a request can match a public route during the routing stage. After the prefix is stripped and the path is normalized, the request resolves to a protected path served by a separate authenticated router. This allows access to protected backend paths, such as admin or internal configuration endpoints, without satisfying the required authentication. This issue is caused by path normalization occurring after the prefix is stripped.

Recommendations Update to version 2.11.48 or later. Update to version 3.6.19 or later. Update to version 3.7.3 or later. As a temporary workaround, use a stricter prefix boundary such as PathRegexp('^/api(/|$)') or use PathPrefix('/api/') combined with StripPrefix('/api/') to block the bypass.