Traefik: Critical Auth Bypass & Privilege Escalation Flaws Disclosed Together
Three Traefik vulnerabilities disclosed on July 22, 2026, include critical authentication bypass and privilege escalation flaws.
Key findings
- Critical authentication bypass via path traversal in ReplacePathRegex middleware (CVE-2026-65600).
- Privilege escalation risk through Kubernetes Gateway API namespace confusion in Traefik v3 (CVE-2026-65601).
- Information disclosure and integrity bypass via IngressRouteTCP cross-provider reference (CVE-2026-65602).
- Three vulnerabilities disclosed together on July 22, 2026, impacting Traefik.
On July 22, 2026, a batch of three critical vulnerabilities was disclosed for Traefik, a popular open-source edge networking solution. These vulnerabilities, reported on the same day, expose users to authentication bypass, privilege escalation, and information disclosure risks. The disclosures highlight potential weaknesses in how Traefik handles Kubernetes Gateway API configurations and its middleware functionalities.
One of the most severe flaws, CVE-2026-65600, is an authentication bypass vulnerability stemming from a path traversal issue within Traefik's ReplacePathRegex middleware. This critical vulnerability, with a CVSSv3 score of 10.0, could allow unauthenticated attackers to gain unauthorized access to sensitive resources by manipulating request paths.
Adding to the severity, CVE-2026-65601 presents a privilege escalation risk within Traefik's v3 when interacting with the Kubernetes Gateway API. This important vulnerability, rated at CVSSv3 9.6, exploits a namespace confusion flaw, potentially allowing an attacker to gain elevated privileges within a Kubernetes cluster.
The third vulnerability, CVE-2026-65602, is a moderate severity flaw (CVSSv3 6.4) related to information disclosure and integrity bypass. It arises from a cross-provider reference in IngressRouteTCP, which could expose sensitive data or allow for unauthorized modifications to traffic routing.
The coordinated disclosure of these three vulnerabilities underscores the importance of timely patching and secure configuration for Traefik deployments, especially those integrated with Kubernetes environments. Users are advised to review the specific versions affected and apply updates as recommended by the Traefik security team to mitigate these risks.
The disclosure of these vulnerabilities on a single day suggests a focused security audit or a coordinated reporting effort. Given the critical and important nature of two of the flaws, immediate attention from administrators managing Traefik instances is warranted. Ensuring that Traefik is updated to a patched version and that configurations related to IngressRouteTCP and the Kubernetes Gateway API are reviewed for potential misconfigurations is crucial for maintaining a secure environment. The potential for authentication bypass and privilege escalation means that these vulnerabilities could be high-priority targets for malicious actors.