Traefik is vulnerable to a path traversal flaw that permits unauthenticated attackers to bypass security controls, posing a significant risk to the integrity of protected services.

This is a path traversal vulnerability (CWE-22) that allows an unauthenticated attacker to manipulate request paths. By leveraging the replacePathRegex middleware, an attacker can bypass defined authentication requirements for backend services.

This vulnerability carries a CVSS score of 7.8, reflecting the high risk posed by unauthenticated access to backend services. A successful exploit could lead to the exposure of sensitive internal APIs or applications that were intended to be protected, resulting in unauthorized data access and potential full system compromise.

Immediate Action: Update Traefik to version 2.11.52, 3.6.23, or 3.7.7 immediately to address the path traversal flaw.

Proactive Monitoring: Review access logs for unusual patterns in URI requests, specifically those utilizing complex regex patterns or unexpected path traversal characters.

Compensating Controls: If immediate patching is not feasible, restrict access to the affected Traefik instances via network-level firewalls or utilize a secondary authentication gateway to verify requests before they reach the vulnerable middleware.

Public Exploit Available: Unknown

Given the critical nature of this authentication bypass, administrators must prioritize upgrading to the specified fixed versions. Failure to patch allows attackers to bypass security layers entirely, making this an urgent remediation priority for all exposed Traefik deployments.