https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:20:43 +0000 https://cve.radiocsirt.org/vuln/cve-2026-65600 <p><strong>Affected:</strong> traefik</p> <p>Traefik versions &lt;= v2.11.51, &gt;= v3.6.0 &lt;= v3.6.22, and &gt;= v3.7.0 &lt;= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex &#34;^/api(.*)&#34;, replacement &#34;/$1&#34;), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.</p> <p><strong>Affected:</strong> traefik</p> <p>Traefik versions &lt;= v2.11.51, &gt;= v3.6.0 &lt;= v3.6.22, and &gt;= v3.7.0 &lt;= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex &#34;^/api(.*)&#34;, replacement &#34;/$1&#34;), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.</p> https://cve.radiocsirt.org/vuln/cve-2026-65600