CVE-2026-65600

🎯 CVE-2026-65600 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-65600 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenti

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.

Klassifikation & Betroffenheit:

CWE-22 traefik traefik 3.6.0 <3.6.23traefik 3.7.0 <3.7.7traefik 0 <2.11.52traefik traefik *

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 🎯 High

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

🛡️ Empfohlene Mitigation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-64 · Using Slashes and URL Encoding Combined … (High) CAPEC-76 · Manipulating Web Input to File System Ca… (Very High) CAPEC-78 · Using Escaped Slashes in Alternate Encod… (High) CAPEC-79 · Using Slashes in Alternate Encoding (High) CAPEC-126 · Path Traversal (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2025-41753 9.3 CVE-2026-77621 9.3 CVE-2026-70009 9.3 CVE-2026-88877 9.3 CVE-2026-85595 9.3

🩹 Patch verfügbar (OSV):

🩹 00d92a043fdee9c562f4b1fda9c2d6f359a25eb2 (Commit) 🩹 84d4e8b139d1ac5e5b2d250fff95baed5ba0584f (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 07/2026

Heute 25.10.

CVSS-Vektor-Analyse: 7.8

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

CNA-Bewertung (VulnCheck): 7.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA…

Veröffentlicht:22.07.2026

Aktualisiert:24.10.2026 13:10

Assigner (CNA):VulnCheck

EUVD-ID:EUVD-2026-47644

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	725	0,2 %
≥50 %	3.220	0,9 %
≥10 %	22.091	5,9 %
<10 %	347.646	93,0 %

Tier

CVEs

Anteil

≥90 %

725

0,2 %

≥50 %

3.220

0,9 %

≥10 %

22.091

5,9 %

<10 %

347.646

93,0 %

CVE-2026-65600 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenti

Traefik versions = v3.6.0 = v3.7.0

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Noch keine Analyse zu CVE-2026-65600

Beitrag zu CVE-2026-65600 verfassen

Zero-Day & Vulnerability Intelligence Hub