An unauthenticated authentication bypass vulnerability in Traefik allows attackers to access protected backend resources by exploiting path normalization discrepancies.

This is an authentication bypass flaw occurring in the StripPrefixRegex middleware, where incorrect byte slicing of percent-encoded paths allows unauthenticated attackers to bypass ForwardAuth, BasicAuth, or DigestAuth by injecting dot-segments that the backend later normalizes.

Successful exploitation of this vulnerability permits unauthorized access to sensitive internal applications or administrative interfaces that are intended to be protected by authentication. Given the CVSS score of 8.2, this represents a significant risk to data confidentiality and integrity, as an attacker can interact with backend services as if they were authorized users, potentially leading to full system compromise or data exfiltration.

Immediate Action: Update Traefik to version 2.11.43, 3.6.14, or 3.7.0-rc.2 immediately to implement the required path normalization fix.

Proactive Monitoring: Review access logs for requests containing suspicious path segments, such as double dots or dot-segments, that precede administrative or sensitive endpoints.

Compensating Controls: If immediate patching is not feasible, consider implementing a Web Application Firewall (WAF) rule to block incoming requests containing dot-segments in the URI path.

Public Exploit Available: No

This vulnerability presents a high risk because it allows for the complete circumvention of authentication mechanisms for backend services. Security teams should prioritize the deployment of the vendor-provided patches across all affected instances to restore secure access control and prevent potential unauthorized entry into critical infrastructure.