CVE-2026-48020 is an authentication bypass in Traefik's StripPrefix middleware. A path containing .. can match a public route, then resolve to a protected router after the prefix is stripped. The NVD record scores it CVSS 10.0. Traefik fixed it in 2.11.48, 3.6.19 and 3.7.3, so upgrade your line.
What's affected
The GitHub advisory lists these affected versions of Traefik:
- 2.11.46 and earlier
- 3.0.0 through 3.6.17
- 3.7.0 through 3.7.1
Patched versions are 2.11.48, 3.6.19 and 3.7.3.
The setup at risk is a public router that matches on a PathPrefix rule and applies the StripPrefix middleware, alongside a separate router, with authentication, that serves paths such as admin or internal endpoints.
The NVD record scores this 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. The GitHub advisory rates it High, with a CVSS 4.0 score of 7.8, and the reporter had proposed Critical. The advisory also says this is not a standalone remote code execution claim in Traefik itself. Impact depends on what the protected backends expose.
How to check if you're exposed
- Find the Traefik version. On a host, run
traefik version. In Docker,docker exec <container> traefik version, or read the image tag withdocker ps. - In Kubernetes, check the image of the Traefik deployment with
kubectl get deploy -A -o wide | grep -i traefik, or read the Helm chart value that sets the tag. - Compare with the affected ranges above.
- Review your dynamic configuration for routers that use PathPrefix together with a StripPrefix middleware. Note which other routers handle the paths behind them and whether authentication is attached only to those other routers.
A configuration where authentication sits only on a second router behind a stripped public prefix is the pattern the advisory describes.
What to do now
- Inventory all Traefik instances, including ingress controllers installed through Helm charts.
- Upgrade to 2.11.48, 3.6.19 or 3.7.3, depending on your line, and redeploy.
- Review routers that use StripPrefix and make sure protected paths enforce authentication at the backend too, not only at the proxy.
- Consider the reporter's suggestion of a stricter prefix boundary, such as PathPrefix with a trailing slash. The advisory notes this is the reporter's verified mitigation and not an official one.
- Check access logs for requests with .. or %2e%2e in the path, and look at what responded.
Why it matters
The record maps this to CWE-22, path traversal, and CWE-288, authentication bypass using an alternate path or channel. The advisory describes an ordering problem. A route is matched on the raw path, then the prefix is removed and the path is normalized, and the result can land on a different route than the one that was checked. It lists Validate Before Canonicalize as a related weakness.
Proxies enforce policy by route, and routes depend on exact path interpretation. When two stages read the same path differently, a rule applied at one stage can be skipped at the other. The lesson for operators is to keep authentication close to the sensitive service as well. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-48020 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Why is the score 10.0 in one place and 7.8 in another?
The NVD record uses CVSS 3.1 with a changed scope, which gives 10.0. The GitHub advisory uses CVSS 4.0 and rates it High at 7.8. Both call for upgrading.
Sources
Last reviewed: 19 October 2026.
