Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN741 _____________________________________________________________________ DATE : 09/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Traefik (Go) versions prior to 2.11.52, 3.6.23, 3.7.7. ===================================================================== https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv _____________________________________________________________________ Authentication Bypass via Path Traversal in ReplacePathRegex Middleware High rtribotte published GHSA-cxjq-mrr5-89rv Package Traefik (Go) Affected versions <= v2.11.51 >= v3.6.0, <= v3.6.22 >= v3.7.0, <= v3.7.6 Patched versions v2.11.52 v3.6.23 v3.7.7 Description Summary There is a critical authentication-bypass vulnerability in Traefik's ReplacePathRegex middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator (for example regex: "^/api(.*)", replacement: "/$1"), a crafted request can produce an un-normalized replacement path such as /../admin, which Traefik forwarded to the backend without validation. A backend that normalizes the path may resolve it to a protected route, letting an unauthenticated attacker reach resources located behind authentication middleware. This is the same class of issue that was fixed for StripPrefix in CVE-2026-48020; that post-replacement normalization check had not been applied to ReplacePathRegex. The fix rejects any request whose replaced path does not match its normalized form. Patches https://github.com/traefik/traefik/releases/tag/v2.11.52 https://github.com/traefik/traefik/releases/tag/v3.6.23 https://github.com/traefik/traefik/releases/tag/v3.7.7 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity High 7.8/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity None Availability None Subsequent System Impact Metrics Confidentiality High Integrity High Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVE ID No known CVE Weaknesses Weakness CWE-22 Credits @C-h4ck-0 C-h4ck-0 Reporter _____________________________________________________________________ Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion Moderate rtribotte published GHSA-qq9q-x9w4-chhj Package Traefik (Go) Affected versions >= v3.7.0, <= v3.7.6 Patched versions v3.7.7 Description Summary There is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware. If the reused middleware sets trusted reverse-proxy identity headers, downstream applications may receive attacker-selected authenticated-identity state. The fix resolves extensionRef against the HTTPRoute namespace. Patches https://github.com/traefik/traefik/releases/tag/v3.7.7 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity Moderate 5.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity None Availability None Subsequent System Impact Metrics Confidentiality High Integrity High Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVE ID No known CVE Weaknesses Weakness CWE-863 Credits @CuB3y0nd CuB3y0nd Reporter _____________________________________________________________________ Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass Moderate rtribotte published GHSA-42cj-m3vj-89wv Package Traefik (Go) Affected versions >= v3.6.0, <= v3.6.22 >= v3.7.0, <= v3.7.6 Patched versions v3.6.23 v3.7.7 Description Summary There is a medium-severity cross-provider reference vulnerability in Traefik's Kubernetes CRD provider. The crossProviderNamespaces allowlist is enforced for HTTP serversTransport references but was not enforced for IngressRouteTCP service serversTransport references. A low-privileged Kubernetes user in a namespace that is not listed in crossProviderNamespaces could set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use the file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. The fix applies the crossProviderNamespaces allowlist to TCP serversTransport references. Patches https://github.com/traefik/traefik/releases/tag/v3.6.23 https://github.com/traefik/traefik/releases/tag/v3.7.7 For more information If you have any questions or comments about this advisory, please open an issue. Original Description Severity Moderate 5.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity None Availability None Subsequent System Impact Metrics Confidentiality High Integrity High Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVE ID No known CVE Weaknesses Weakness CWE-863 Credits @CuB3y0nd CuB3y0nd Reporter ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================