CVE-2026-48020 Details
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.
A high-severity vulnerability has been identified in Traefik's StripPrefix middleware, allowing an unauthenticated attacker to bypass route-level authentication and authorization. This issue affects Traefik versions prior to 2.11.48, 3.6.17, and 3.7.1. The vulnerability arises when a public router applies a PathPrefix rule with the StripPrefix middleware. A request path containing '..' or its percent-encoded form can initially match the public route. After the prefix is removed and the path is normalized, it can redirect to a path on a separate, authenticated router. Consequently, an attacker could access protected backend paths, such as admin or internal configuration endpoints, without going through the required authentication on the protected router.
Users can upgrade to Traefik versions 2.11.48, 3.6.19, or 3.7.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:62260 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-48020 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2491915 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48020.json | redhat-SADP | |
| https://github.com/traefik/traefik/releases/tag/v2.11.48 | [email protected] | PatchRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.6.19 | [email protected] | PatchRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.7.3 | [email protected] | PatchRelease Notes |
| https://github.com/traefik/traefik/security/advisories/GHSA-xf64-8mw2-4gr2 | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | redhat-SADP |
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | < 2.11.48 >= 3.0.0, < 3.6.19 >= 3.7.0, < 3.7.3 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |