Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does not match the protected path patterns and therefore allows the request through. The backend then normalizes the dot-segment to the real path per RFC 3986 and serves the protected content An unauthenticated attacker can exploit this against any backend that performs dot-segment normalization. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

The version of Traefik installed on the remote macOS host is prior to 2.11.43 or 3.x prior to 3.6.14. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass via StripPrefixRegex and ForwardAuth dot-segment normalization. When StripPrefixRegex     processes URLs with percent-encoded characters, it miscalculates byte offsets, producing a dot-segment path that     authentication middleware fails to match against protection rules. (CVE-2026-40912)

  - An authentication bypass via unsanitized underscore-variant forwarded headers. Traefik's forwarded-header     sanitization logic targets only canonical header names and does not strip alias variants that use underscores     instead of dashes, allowing attackers to inject forged trust context to bypass ForwardAuth. (CVE-2026-39858)

  - An authentication bypass in ForwardAuth when trustForwardHeader is set to false behind a trusted proxy. The     X-Forwarded-Prefix header remains unstripped in authentication subrequests, allowing external attackers to     spoof the header and bypass access controls on protected routes. (CVE-2026-35051)

  - A timing side-channel in BasicAuth that allows username enumeration via bcrypt short-circuit. Due to a map     key/value confusion bug, a fallback security mechanism fails to function properly, enabling attackers to     enumerate valid usernames by analyzing response-time differences. (CVE-2026-41263)

  - A Kubernetes CRD cross-namespace isolation bypass via Chain middleware references. When     allowCrossNamespace is set to false, Traefik fails to apply the same restriction to middleware references     nested inside a Chain middleware, allowing actors to access middleware from other namespaces. (CVE-2026-41174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2,
    there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when
    used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against
    the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot
    (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-
    segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does
    not match the protected path patterns and therefore allows the request through. The backend then
    normalizes the dot-segment to the real path per RFC 3986 and serves the protected content An
    unauthenticated attacker can exploit this against any backend that performs dot-segment normalization.
    This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2. (CVE-2026-40912)

ID	Name	Product	Family	Type	Severity
311474	Traefik < 2.11.43 / 3.x < 3.6.14 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high
440799	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-6jwx-7vp4-9847)	Tenable Cloud Security	SCA Checks	Local	high
440799	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-6jwx-7vp4-9847)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-40912

high

Tenable Plugins

high

high

high