7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40912

CVE-2026-40912: Traefik: StripPrefixRegex auth bypass via Path/RawPath desync

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does not match the protected path patterns and therefore allows the request through. The backend then normalizes the dot-segment to the real path per RFC 3986 and serves the protected content An unauthenticated attacker can exploit this against any backend that performs dot-segment normalization. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40912

CVE-2026-40912:

7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v3	go	>= 3.7.0-ea.1, < 3.7.0-rc.2	3.7.0-rc.2
github.com/traefik/traefik/v3	go	>= 3.0.0-beta1, < 3.6.14	3.6.14
github.com/traefik/traefik/v2	go	< 2.11.43	2.11.43
github.com/traefik/traefik	go	<= 1.7.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Traefik's StripPrefix and StripPrefixRegex middlewares and allows for an authentication bypass. The root cause is a path desynchronization issue. The middlewares would match a prefix on the URL's decoded path but then use the length of that match to slice the raw, percent-encoded path. An attacker could exploit this by including percent-encoded characters, such as %2e (a dot), in the prefix portion of the URL. When the middleware stripped the prefix, it would create a malformed path like /./admin/secret. Authentication middlewares like ForwardAuth would inspect this path, not match it against protected patterns (e.g., /admin/*), and allow the request. However, the backend service would then normalize the path according to RFC 3986, resolving /./admin/secret to /admin/secret and serving the protected content, thus bypassing the authentication control. The patch for this vulnerability involves sanitizing the URL by calling req.URL.JoinPath() after the prefix has been stripped. This function rebuilds the URL, correctly resolving any dot-segments or other path traversal sequences, ensuring that the path sent to subsequent middlewares and the backend is clean and canonical.

Vulnerable functions

stripPrefixRegex.ServeHTTP

pkg/middlewares/stripprefixregex/strip_prefix_regex.go

This function is vulnerable to an authentication bypass. It processes incoming HTTP requests and strips a prefix from the URL based on a regular expression. The vulnerability lies in how it handles percent-encoded characters in the URL. The length of the matched prefix from the decoded path is used to slice the raw, encoded path. This discrepancy can be exploited by an attacker using percent-encoded characters (like `%2e` for a dot) to create a path with dot-segments (e.g., `/./admin/secret`) after the prefix is stripped. This malformed path can bypass authentication middleware, which doesn't recognize it as a protected path, but is later normalized by the backend server, granting access to protected resources.

stripPrefix.ServeHTTP

pkg/middlewares/stripprefix/strip_prefix.go

This function is also vulnerable to the same authentication bypass as `stripPrefixRegex.ServeHTTP`. It strips a static prefix from the URL path. An attacker can craft a URL where the part to be stripped contains percent-encoded characters. This leads to an inconsistent state between the URL's `Path` and `RawPath`, resulting in a path with dot-segments being forwarded. This can bypass authentication controls while still allowing access to protected backend resources that normalize the path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.