Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.

The version of Traefik installed on the remote macOS host is 3.7.x prior to 3.7.8. It is, therefore, affected by a path traversal vulnerability:

  - A path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware allows an     unauthenticated attacker to craft requests that bypass route-level authentication (BasicAuth, DigestAuth, or     ForwardAuth) by exploiting dot-segment traversal in rewritten paths. (CVE-2026-67309)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress
    NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target
    annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a
    path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin
    matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded
    without post-replacement normalization validation. A backend that normalizes dot segments resolves the
    path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with
    BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed
    in v3.7.8. (CVE-2026-67309)

ID	Name	Product	Family	Type	Severity
335169	Traefik 3.7.0 < 3.7.8 Path Traversal Authentication Bypass (CVE-2026-67309)	Nessus	MacOS X Local Security Checks	Local	high
445740	SCA: security update for github.com/traefik/traefik/v3 (GHSA-8rxv-jg7p-wvg3)	Tenable Cloud Security	SCA Checks	Local	high
445740	SCA: security update for github.com/traefik/traefik/v3 (GHSA-8rxv-jg7p-wvg3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-67309

high

Tenable Plugins

high

high

high