Critical Path Traversal Flaw in Traefik Exposes Sensitive Endpoints to Unauthenticated Attackers

Overview

CVE-2026-48020 (CVSS 10.0) is a zero-day vulnerability in Traefik's StripPrefix middleware that allows unauthenticated attackers to bypass authentication and access protected routes. Attackers can exploit path traversal sequences to reach admin or internal endpoints without credentials.

Technical Analysis

The vulnerability stems from improper normalization of path traversal sequences (.. or %2e%2e) in public routers using StripPrefix. During routing, malicious paths match public route rules, but post-processing normalization resolves them to protected backend routes. Exploitation requires crafting HTTP requests with traversal patterns in the URL path, enabling access to restricted API endpoints, configuration interfaces, or administrative panels.

Enterprise & DIB Impact

Defense Industrial Base (DIB) and enterprise environments using Traefik for API gateway or ingress controller responsibilities face immediate risk. Attackers could compromise sensitive systems by accessing internal services protected by authentication middleware that would otherwise prevent unauthorized access. This flaw undermines the security of exposed microservices and infrastructure components.

Recommended Actions

• Upgrade to Traefik 2.11.48
• 3.6.19
• or 3.7.3 immediately
• Audit all route configurations for public routers using StripPrefix middleware
• Implement additional path validation layers (e.g.
• JWT authentication