Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.

The version of Traefik installed on the remote macOS host is 2.x prior to 2.11.48, 3.x prior to 3.6.19, or 3.7.x prior to 3.7.3. It is, therefore, affected by an authentication bypass vulnerability:

  - The StripPrefix middleware allows unauthenticated attackers to bypass route-level authentication by crafting     requests with path traversal sequences. Requests matching a public route with PathPrefix are prefix-stripped and     path-normalized to resolve to protected paths guarded by an authenticated router. (CVE-2026-48020)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 57e69b2c-67b2-11f1-b3b6-5404a68ad561 advisory.

    The traefik project releases a new version addressing multiple CVEs:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high
    severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to
    bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and
    applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can
    match the public route at routing time and then, after the prefix is stripped and the path is normalized,
    resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected
    backend paths — such as admin or internal configuration endpoints — without satisfying the authentication
    middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.
    (CVE-2026-48020)

ID	Name	Product	Family	Severity
321447	Traefik 2.x < 2.11.48 / 3.x < 3.6.19 / 3.7.x < 3.7.3 Authentication Bypass (CVE-2026-48020)	Nessus	MacOS X Local Security Checks	high
321074	FreeBSD : traefik -- Multiple vulnerabilities (57e69b2c-67b2-11f1-b3b6-5404a68ad561)	Nessus	FreeBSD Local Security Checks	high
443076	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-xf64-8mw2-4gr2)	Tenable Cloud Security	SCA Checks	high
443076	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-xf64-8mw2-4gr2)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-48020

high

Tenable Plugins

high

high

high

high