7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48020

CVE-2026-48020: Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48020

CVE-2026-48020:

7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v2	go	< 2.11.48	2.11.48
github.com/traefik/traefik/v3	go	< 3.6.19	3.6.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Traefik's StripPrefix and StripPrefixRegex middlewares, which failed to properly validate request paths after modification. An attacker could craft a URL containing path traversal sequences (like ..). Traefik's router would match the request to a less-privileged route based on the prefix (e.g., /api). After the middleware stripped the prefix, the remaining path (e.g., ../admin) would be normalized, resolving to a protected path (/admin). Since authentication was bypassed at the routing stage, the request would be forwarded to the protected backend endpoint without authorization. The fix, identified in pull request #13215, was to add a check within the ServeHTTP methods of both middlewares. This check compares the path before and after normalization. If the path is altered by normalization, it indicates a malicious attempt, and the request is rejected with a 400 Bad Request. The vulnerable functions are stripPrefix.ServeHTTP and stripPrefixRegex.ServeHTTP because they contained the flawed logic that processed and forwarded the manipulated path.

Vulnerable functions

stripPrefix.ServeHTTP

pkg/middlewares/stripprefix/strip_prefix.go

The `ServeHTTP` function in the `stripPrefix` middleware is vulnerable. Before the patch, it would strip a prefix from the request path and then normalize the result using `req.URL.JoinPath()`. This allowed an attacker to use path traversal characters (e.g., `..`) to bypass routing-level authentication. For example, a request to `/api../admin` would match a public route for `/api`, but after stripping `/api` and normalizing `../admin`, the request would be forwarded to the protected `/admin` endpoint. The patch fixes this by comparing the path before and after normalization and rejecting the request if they differ.

stripPrefixRegex.ServeHTTP

pkg/middlewares/stripprefixregex/strip_prefix_regex.go

Similar to `stripPrefix`, the `ServeHTTP` function in the `stripPrefixRegex` middleware was also vulnerable to the same path normalization bypass. It would strip a prefix based on a regular expression and then normalize the path, allowing access to protected endpoints. The patch applies the same fix: it checks if the path has changed after normalization and rejects the request if it has.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.