{"vulnerability": "ghsa-8rxv-jg7p-wvg3", "sightings": [{"uuid": "248a7467-52c5-4887-8b4f-b88a54cd2962", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8rxv-jg7p-wvg3", "type": "seen", "source": "https://gist.github.com/alon710/73aecb4bf7a9c9303fe6451f784d95ea", "content": "# CVE-2026-67309: CVE-2026-67309: Path Traversal and Authentication Bypass in Traefik RewriteTarget Middleware\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67309\n\n## Summary\nA high-severity path traversal vulnerability exists in Traefik's Kubernetes Ingress NGINX provider. The flaw resides in the RewriteTarget middleware, which is auto-generated when an Ingress resource specifies the `nginx.ingress.kubernetes.io/rewrite-target` annotation. This allows remote, unauthenticated attackers to bypass route-level authentication and access restricted downstream endpoints by exploiting a parser differential.\n\n## TL;DR\nUnauthenticated remote attackers can bypass Traefik's routing-layer security controls via relative dot-segment path traversals, gaining unauthorized access to restricted downstream backend resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0**: 7.8 (High)\n- **EPSS Score**: 0.00492\n- **Exploit Status**: PoC (No Weaponized)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Traefik Proxy (Kubernetes Ingress NGINX provider environment with RewriteTarget enabled)\n- **Traefik**: >= v3.7.0, <= v3.7.7 (Fixed in: `v3.7.8`)\n\n## Mitigation\n\n- Upgrade Traefik to v3.7.8 or higher.\n- Enforce strict Ingress path regular expression matching by requiring trailing slashes.\n- Implement downstream validation rules to reject unnormalized URI segments.\n\n**Remediation Steps:**\n1. Identify all Kubernetes Ingress resources utilizing 'nginx.ingress.kubernetes.io/rewrite-target' or custom regex path replacement.\n2. Audit matching rules to ensure wildcards are separated by explicit directory boundaries (e.g., '/api/(.*)').\n3. Deploy Traefik v3.7.8 using Helm, YAML manifests, or the official Docker image update.\n4. Verify incoming logs for HTTP 400 responses indicating rejected path traversal attempts.\n\n## References\n\n- [GitHub Security Advisory GHSA-8rxv-jg7p-wvg3](https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67309) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T19:32:23.752299Z"}]}