Traefik StripPrefix route-level authentication bypass via path normalization

CVE-2026-48020 affects Traefik when a public router uses PathPrefix together with the StripPrefix middleware, and a separate router protects sensitive paths like /admin or /internal/config with authentication. In vulnerable builds (<= v2.11.46, <= v3.6.17, <= v3.7.1), a request such as /api../admin or /api%2e%2e/admin can match the public route first, then be normalized after prefix stripping into a protected backend path. The result is route-level auth bypass, not a generic Traefik takeover.

The vendor/CNA tagged this High with CVSS v4 7.8, and the underlying bug is real. Operationally, though, that overstates fleet-wide urgency: exploitation requires a fairly specific routing pattern, internet reachability, and a backend path that becomes sensitive only after normalization. For a 10,000-host estate, this is a configuration-dependent edge-proxy bug with potentially serious local impact but a meaningfully narrower exposed population than a universal unauthenticated RCE.

Why this verdict

• Unauthenticated remote is real — attacker position is internet-facing and no credentials or user interaction are needed once the bad route design exists, so this is not hand-wavy lab-only theory.
• Config dependency cuts the reachable population — exploitation requires a public PathPrefix route, StripPrefix, a separate protected route, and backend-sensitive paths behind the same proxy. That compounding prerequisite stack pushes the score down from the vendor-style baseline.
• Impact is boundary bypass, not platform takeover — the bug can expose admin/internal functionality and even enable downstream RCE *if* the backend already has an execution primitive, but Traefik itself is not handing out code execution or host compromise.

Why not higher?

This is not a universal pre-auth RCE, memory corruption bug, or auth bypass that fires on default installs. Real-world exploitability depends on an operator-created routing topology that many enterprises will simply not have, and some backends will still enforce their own auth after the proxy mistake.

Why not lower?

The attack is still unauthenticated, remote, and edge-facing where present, which always matters more than an internal-only footgun. If the vulnerable pattern exists in front of admin or internal APIs, the business impact can be immediate and ugly even without host-level compromise.

1. Hunt for StripPrefix on public routes — Search file-provider configs, Helm values, Kubernetes CRDs, Docker labels, and Compose manifests for public routers that combine PathPrefix and StripPrefix. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this hunt is fast and should be done early because it identifies the small subset that actually matters.
2. Tighten prefix boundaries — Where you cannot patch immediately, change public route matching from loose patterns to stricter ones the advisory verified in lab, such as PathRegexp(^/api(/|$)) or PathPrefix(/api/) with StripPrefix(/api/). There is no noisgate mitigation SLA for MEDIUM, so apply this opportunistically where config changes are easy while planning patching inside the remediation window.
3. Block traversal-style payloads upstream — Add WAF/CDN/ingress filtering for requests containing .., %2e%2e, and similar encoded dot-segment tricks on public prefixes that feed Traefik. This is a solid temporary choke point, especially for internet-facing proxies, but it should be treated as a hardening measure rather than the primary fix.
4. Require backend-side auth for admin paths — Do not rely solely on Traefik route boundaries for truly sensitive endpoints. If admin or internal APIs also enforce application auth, the proxy bypass collapses into a noisy but non-fatal routing bug.
5. Patch to fixed Traefik releases — Move affected instances to v2.11.48, v3.6.19, or v3.7.3. For this MEDIUM assessment there is no mitigation SLA — go straight to the 365-day remediation window, but externally exposed edge proxies using the risky pattern should be prioritized well ahead of that outer deadline.

Run this on the Traefik host, container node, or CI image-validation job. Invoke it as sudo bash verify-cve-2026-48020.sh /etc/traefik or point it at the directory where your Traefik YAML/TOML/labels live; root is helpful if you want it to inspect Docker metadata and protected config paths. The script returns VULNERABLE when it finds both a vulnerable Traefik version and risky config indicators, PATCHED when the version is fixed, and UNKNOWN when it cannot prove either state.

#!/usr/bin/env bash
# verify-cve-2026-48020.sh
# Detect likely exposure to CVE-2026-48020 (Traefik StripPrefix route-level auth bypass)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

CFG_DIR="${1:-/etc/traefik}"
VERSION=""
FOUND_SOURCE=""
RISKY_CONFIG=0
STRIPPREFIX_FOUND=0
PATHPREFIX_FOUND=0
AUTH_HINT_FOUND=0

verlte() {
  [ "$1" = "$2" ] && return 0
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

vergte() {
  [ "$1" = "$2" ] && return 0
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

extract_semver() {
  echo "$1" | grep -Eo 'v?[0-9]+\.[0-9]+\.[0-9]+' | head -n1
}

check_fixed() {
  local v="$1"
  if vergte "$v" "v3.7.3"; then return 0; fi
  if vergte "$v" "v3.6.19" && verlte "$v" "v3.6.999"; then return 0; fi
  if vergte "$v" "v2.11.48" && verlte "$v" "v2.11.999"; then return 0; fi
  return 1
}

check_vuln_range() {
  local v="$1"
  if vergte "$v" "v3.7.0" && verlte "$v" "v3.7.1"; then return 0; fi
  if vergte "$v" "v3.6.0" && verlte "$v" "v3.6.17"; then return 0; fi
  if vergte "$v" "v2.11.0" && verlte "$v" "v2.11.46"; then return 0; fi
  return 1
}

# 1) Try local traefik binary
if command -v traefik >/dev/null 2>&1; then
  VERSION=$(traefik version 2>/dev/null | grep -Eo 'Version:\s*v?[0-9]+\.[0-9]+\.[0-9]+' | awk '{print $2}')
  if [ -n "$VERSION" ]; then
    FOUND_SOURCE="local traefik binary"
  fi
fi

# 2) Try Docker image / running container if version still unknown
if [ -z "$VERSION" ] && command -v docker >/dev/null 2>&1; then
  VERSION=$(docker ps --format '{{.Image}}' 2>/dev/null | grep -E '^traefik:v?[0-9]+\.[0-9]+\.[0-9]+' | head -n1 | sed 's/^traefik://')
  if [ -n "$VERSION" ]; then
    FOUND_SOURCE="running docker image"
  fi
fi

# 3) Try podman
if [ -z "$VERSION" ] && command -v podman >/dev/null 2>&1; then
  VERSION=$(podman ps --format '{{.Image}}' 2>/dev/null | grep -E '^traefik:v?[0-9]+\.[0-9]+\.[0-9]+' | head -n1 | sed 's/^traefik://')
  if [ -n "$VERSION" ]; then
    FOUND_SOURCE="running podman image"
  fi
fi

# Normalize version prefix
if [ -n "$VERSION" ]; then
  VERSION=$(extract_semver "$VERSION")
  case "$VERSION" in
    v*) ;;
    *) VERSION="v$VERSION" ;;
  esac
fi

# Config inspection
if [ -d "$CFG_DIR" ]; then
  if grep -RIEq 'stripPrefix|stripprefix' "$CFG_DIR" 2>/dev/null; then
    STRIPPREFIX_FOUND=1
  fi
  if grep -RIEq 'PathPrefix\(|pathprefix|PathRegexp\(' "$CFG_DIR" 2>/dev/null; then
    PATHPREFIX_FOUND=1
  fi
  if grep -RIEq 'basicAuth|digestAuth|forwardAuth|jwt|oidc|oauth|ipAllowList|ipWhiteList|middlewares:.*auth|authentication' "$CFG_DIR" 2>/dev/null; then
    AUTH_HINT_FOUND=1
  fi
fi

if [ "$STRIPPREFIX_FOUND" -eq 1 ] && [ "$PATHPREFIX_FOUND" -eq 1 ]; then
  RISKY_CONFIG=1
fi

# Decision logic
if [ -n "$VERSION" ] && check_fixed "$VERSION"; then
  echo "PATCHED: Traefik version $VERSION ($FOUND_SOURCE) is at or above a fixed release for its branch."
  exit 0
fi

if [ -n "$VERSION" ] && check_vuln_range "$VERSION"; then
  if [ "$RISKY_CONFIG" -eq 1 ]; then
    echo "VULNERABLE: Traefik version $VERSION is in an affected range and config under $CFG_DIR contains StripPrefix + PathPrefix indicators."
    if [ "$AUTH_HINT_FOUND" -eq 1 ]; then
      echo "NOTE: Auth-related middleware hints were also found; review for public-prefix to protected-path bypass patterns."
    fi
    exit 1
  fi
  echo "UNKNOWN: Traefik version $VERSION is in an affected range, but this script did not prove the risky routing pattern in $CFG_DIR."
  exit 2
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: Could not determine Traefik version from local binary or container runtime."
  exit 2
fi

echo "UNKNOWN: Detected version $VERSION, but branch/fix status could not be classified by this script."
exit 2

Sources

1. Traefik GHSA-xf64-8mw2-4gr2 advisory
2. Traefik release v3.7.3
3. Traefik fix PR #13215
4. CERT-FR advisory CERTFR-2026-AVI-0690
5. Traefik StripPrefix documentation
6. Traefik routers documentation
7. Traefik entryPoints documentation
8. Censys blog on exposed Traefik dashboards