A critical flaw in Traefik lets a remote attacker with no credentials walk past the authentication rules the proxy is enforcing and reach routes that were supposed to be protected. Traefik is a reverse proxy and load balancer widely used to route HTTP traffic into container and Kubernetes environments, and in many deployments it is the component deciding who is allowed to reach an internal service at all.
The bug, CVE-2026-65600, is a path traversal in the ReplacePathRegex middleware, the feature that rewrites a request's URL path with a regular expression before passing it on. Traefik does not properly re-check whether the rewritten path changes once it has been normalised. So an attacker can send a crafted request whose path Traefik matches against a permissive rule, for example one shaped like /../admin, which the backend application then normalises to /admin and serves. The routing decision is made on one version of the path and the request is answered against another.
What's affected
Versions across all three branches are affected: Traefik 1.7.34 and earlier, v2.11.51 and earlier, v3.6.22 and earlier, and v3.7.0 through v3.7.6. The bypass covers reads and writes alike, so GET, POST, PUT and DELETE requests can all reach protected paths, which makes it a data modification problem and not only a data exposure one. No exploitation has been reported so far.
What you should do
Upgrade Traefik v2 to 2.11.52 or later, the v3.6 line to 3.6.23 or later, and the v3.7 line to 3.7.7 or later. There is no fixed release for the 1.x branch, which reached end of support, so anyone still running it has to migrate to a supported version rather than patch. Review any configuration that uses ReplacePathRegex, particularly where the middleware protects or routes sensitive paths, and check Traefik and backend application logs for HTTP requests carrying traversal sequences such as ../ in the path. The same bulletin also flags critical remote code execution flaws in Veeam ONE, without further technical detail.
Where this came from
The advisory reaching us is bulletin 142-2026 from Peru's Centro Nacional de Seguridad Digital (CNSD), the national digital security centre, published on 7 August and readable in Spanish in the CNSD bulletin. The vulnerability itself was found and fixed by the Traefik project, whose own security advisory carries the authoritative version matrix and remediation guidance; the CNSD bulletin restates it for Peruvian organizations and does not add local telemetry.
Path handling keeps producing this class of bug in infrastructure that everyone treats as plumbing. IntelFusions covered a set of Kubernetes storage flaws that let one tenant read another tenant's files in July, and a currently unpatched F5 BIG-IP DNS flaw this week. Perimeter and routing components are worth the same patch urgency as the applications behind them, because a bypass there quietly removes a control every service downstream assumes is working.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.