Traefik - Authentication Bypass - Version Detection

id: CVE-2026-65600

info:
  name: Traefik - Authentication Bypass - Version Detection
  author: DhiyaneshDk
  severity: high
  description: |
    Traefik versions <= v2.11.51, >= v3.0.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware (CVE-2026-65600). This template passively identifies vulnerable versions by reading the version reported on the Traefik API (/api/version), which is exposed when the dashboard/API is reachable (e.g. api.insecure=true or the api@internal service routed without auth).
  impact: |
    On an affected version configured with a ReplacePathRegex capture group lacking a mandatory separator, an unauthenticated attacker can bypass BasicAuth, ForwardAuth, or DigestAuth middleware and reach protected backend routes.
  remediation: |
    Update to Traefik v2.11.52, v3.6.23, or v3.7.7 or later, and do not expose the Traefik dashboard/API unauthenticated on an internet-facing entrypoint.
  reference:
    - https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65600
    - https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-65600
    epss-score: 0.00503
    epss-percentile: 0.43587
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: traefik
    product: traefik
    shodan-query: http.title:"Traefik"
    fofa-query: app="Traefik"
  tags: cve,cve2026,traefik,auth-bypass,vkev,passive

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/version"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"Version"'
          - '"Codename"'
        condition: and

      - type: dsl
        dsl:
          - "compare_versions(version, '<= 2.11.51') || (compare_versions(version, '>= 3.0.0') && compare_versions(version, '<= 3.6.22')) || (compare_versions(version, '>= 3.7.0') && compare_versions(version, '<= 3.7.6'))"

    extractors:
      - type: regex
        name: version
        internal: true
        part: body
        group: 1
        regex:
          - '"[Vv]ersion":\s*"v?([0-9]+\.[0-9]+\.[0-9]+)"'

      - type: regex
        part: body
        group: 1
        regex:
          - '"[Vv]ersion":\s*"(v?[0-9]+\.[0-9]+\.[0-9]+)"'