A critical vulnerability in Traefik allows unauthenticated attackers to bypass security controls including authorization and routing, potentially exposing sensitive backend services.

The application incorrectly processes rootless HTTP/1 request targets, causing the proxy to normalize paths for security checks while forwarding the raw, unvalidated input to the backend. This allows unauthenticated remote attackers to evade access logs and bypass path-based authorization policies.

This vulnerability poses a significant risk to the integrity of network security boundaries. Because the flaw allows for cross-vhost routing and authorization bypass, an attacker could access restricted internal services or endpoints that were intended to be protected by the proxy. With a CVSS score of 8.8, this represents a high-severity threat that could lead to unauthorized data access or service exploitation.

Immediate Action: Update Traefik to version 2.11.57 or 3.7.13 immediately to implement the necessary request target validation.

Proactive Monitoring: Review access logs for unusual HTTP request patterns, specifically looking for requests that utilize opaque targets or deviate from standard path structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block HTTP requests containing unexpected or malformed request targets that do not conform to standard URI path specifications.

Public Exploit Available: Unknown

Given the potential for unauthorized access to backend systems, organizations utilizing Traefik should prioritize this update within their immediate maintenance window. The ability for an attacker to bypass authentication and access logging makes this a high-priority risk that requires prompt patching to ensure the ongoing security of the application infrastructure.