Traefik versions >=3.7.0 and <=3.7.7 have a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware, triggered by regex path captures that do not require a path separator. An attacker can craft requests such as /api../admin that are rewritten to '/../admin' and forwarded without proper normalization validation. If the backend normalizes dot segments, this can lead to access to protected endpoints that should be secured by separate authentication mechanisms, effectively bypassing route-level authentication controls. The vulnerability is tracked as CVE-2026-67309 and is resolved in Traefik version 3.7.8.

An attacker can bypass route-level authentication mechanisms (BasicAuth, DigestAuth, ForwardAuth) by exploiting the path traversal vulnerability, gaining unauthorized access to protected backend endpoints. This undermines the security controls intended to restrict access to sensitive routes, potentially exposing administrative or otherwise protected functionality.

Upgrade Traefik to version 3.7.8 or later, where this path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware is fixed. No other mitigations are specified or required once the patch is applied.