CVE-2026-67309 is a high severity path traversal in the Kubernetes Ingress NGINX provider of Traefik 3.7.0 through 3.7.7. A rewrite target annotation can produce a traversal path after routing, which can reach content protected by a separate route's authentication. Upgrade to Traefik v3.7.8.
What's affected
Traefik v3.7.0 through v3.7.7, per the GitHub advisory. The patched version is v3.7.8. The advisory notes the issue remains exploitable in the v3.7.7 release.
Severity differs by source. The record gives CVSS 7.5 (High). The GitHub advisory header says High, while its original report proposes Critical, with a CVSS 3.1 score of 9.1. The page also shows a High score of 7.8 in its severity field. So the sources land between 7.5 and 9.1, and the exposure depends on your routing.
The weakness is CWE-22. The advisory says the issue sits in the RewriteTarget middleware that Traefik generates from the nginx.ingress.kubernetes.io/rewrite-target annotation. It occurs when an Ingress path uses a regular expression that captures attacker controlled text without requiring a path separator. The rewrite can turn a safe looking path into one with dot segments after the router has already been chosen, and the middleware forwards it without checking.
A backend that normalizes such paths then resolves them to a protected route, reachable through a separate router that applies BasicAuth, DigestAuth or ForwardAuth.
How to check if you're exposed
Check the Traefik version and look for the annotation:
traefik version
kubectl get ingress -A -o yaml | grep -n "rewrite-target"
You are only in scope if you use the Kubernetes Ingress NGINX provider, on a version in the range, with rewrite targets that use capture groups. Look at each match. A capture group that follows a path separator is a different case from one that captures anything after a prefix.
Also ask what sits behind the proxy. The bypass relies on a backend that normalizes dot segments and exposes a protected route that is guarded only at the proxy.
What to do now
- Upgrade Traefik to v3.7.8.
- List every Ingress that uses the rewrite-target annotation with a regular expression capture.
- Rewrite such paths so the captured text must follow a path separator, and test them.
- Apply authentication in the backend as well, for routes that must not be reachable without it.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
The proxy decides which router handles a request before it rewrites the path. If the rewrite then changes the meaning of the path, the access rules chosen for the first path no longer match what the backend sees. That is the gap this bug lives in.
The advisory calls this an unpatched sibling of an earlier fix that added a normalization check to a different middleware. The same check was missing in this one. Authentication that exists only at the edge can fail when the edge and the backend read a path differently, so defense in depth helps.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does it affect all Traefik users?
No. It affects the Kubernetes Ingress NGINX provider on 3.7.0 through 3.7.7, with a rewrite pattern that captures text without a path separator.
Is v3.7.7 safe?
No. The advisory says the bypass remains exploitable in v3.7.7. Use v3.7.8.
Sources
Last reviewed: 18 October 2026.
