CVE Intelligence
Analysis AI-assisted

CVE-2026-48020: Traefik StripPrefix Middleware Authentication Bypass

CVE-2026-48020 is a path-handling flaw in the StripPrefix middleware of Traefik, an HTTP reverse proxy and load balancer, affecting releases before 2.11.48, 3.6.19 and 3.7.3. According to the record, an unauthenticated attacker may reach routes protected by authentication middleware when a public PathPrefix router uses StripPrefix. The issue is fixed in 2.11.48, 3.6.19 and 3.7.3, and the record does not show confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-48020 is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The NVD record describes a case where a public router with a PathPrefix rule and the StripPrefix middleware can let a request path with dot-segments (.. or %2e%2e) be handled as a public route at matching time, then resolve to a path served by a separate authenticated router after prefix stripping and normalization. The description is available in the NVD entry and the CVE Record.

Impact

  • The record states that an unauthenticated attacker may reach protected backend paths, such as administrative or internal configuration endpoints, without satisfying the authentication middleware on the protected router.
  • NVD scores the issue at 10.0 under CVSS 3.1 with high confidentiality and integrity impact and no availability impact. The record also lists a 7.8 score under CVSS 4.0 from the GitHub CNA and a 9.1 score under CVSS 3.1 from a provider not named in the record.
  • The record's severity field is critical, while the description calls the issue high severity. This difference is not explained in the record.

Affected products and versions

  • Product listed: Traefik Traefik.
  • Affected ranges: versions before 2.11.48; versions from 3.0.0 up to but not including 3.6.19; and versions from 3.7.0 up to but not including 3.7.3.
  • Fixed releases named in the record: 2.11.48, 3.6.19 and 3.7.3.
  • Deployments that use PathPrefix routers together with StripPrefix on public routes are the configuration described in the record. Whether a given deployment matches this pattern requires local review.

Exploitation status

  • The KEV catalog flag in the record is false, so this CVE is not listed as known exploited by the record's data.
  • No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
  • The GitHub advisory is tagged Exploit in the reference list. This tag does not confirm that exploitation has occurred, and the content behind it was not available for verification.
  • The EPSS score is not present in the record.

Remediation and mitigation

  • Upgrade Traefik to 2.11.48 or later in the 2.11 line, 3.6.19 or later in the 3.6 line, or 3.7.3 or later in the 3.7 line, as described in the GitHub advisory.
  • Prioritize deployments that expose public routers using PathPrefix together with StripPrefix, and confirm that protected backends are not reachable through those public routes.
  • Review the vendor advisory and release notes for any further guidance on configuration changes before and after upgrading.
  • The record does not include a documented workaround, so compensating controls cannot be verified from the available data.

Detection guidance

  • Review access logs for requests on public routes that contain dot-segments or their percent-encoded forms, and check whether any of them reached protected backend paths.
  • Check whether administrative or internal configuration paths were accessed without the expected authentication context.
  • Verify the running Traefik version against the fixed releases listed above across all environments, including container images and load balancer nodes.

Limitations of the available information

  • The record does not describe the exact conditions under which the normalization step resolves to a protected router, so the precise exposure of a given deployment cannot be determined from the record alone.
  • The discrepancy between the critical severity field and the high severity wording is unexplained.
  • The provider of the 9.1 score is not identified in the record.
  • No proof-of-concept details, workarounds or exploitation telemetry are included in the sources consulted.

Frequently asked questions

Which Traefik versions are fixed for CVE-2026-48020?

The record lists fixes in 2.11.48, 3.6.19 and 3.7.3. Affected ranges are versions before 2.11.48, from 3.0.0 to before 3.6.19, and from 3.7.0 to before 3.7.3.

Is CVE-2026-48020 known to be exploited?

The record shows KEV listed as false, and no confirmed active exploitation appears in the sources consulted. The GitHub advisory carries an Exploit tag, but this does not confirm exploitation.

Which CVSS score should be used for this CVE?

NVD lists 10.0 under CVSS 3.1. The record also includes a 7.8 score under CVSS 4.0 from the GitHub CNA and a 9.1 score under CVSS 3.1 from an unnamed provider, so the score depends on the source used.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.