CVE-2026-48020

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.

• CWE-288
• CWE-22

• https://github.com/traefik/traefik/releases/tag/v2.11.48Patch, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.6.19Patch, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.7.3Patch, Release Notes
• https://github.com/traefik/traefik/security/advisories/GHSA-xf64-8mw2-4gr2Exploit, Mitigation, Patch, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:62260
• https://access.redhat.com/security/cve/CVE-2026-48020
• https://bugzilla.redhat.com/show_bug.cgi?id=2491915
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48020.json

Published

Jun 23, 2026

Last Modified

Sep 2, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48014Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5
• CVE-2026-48015Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.9
• CVE-2026-48016Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.3
• CVE-2026-48017DbGate is cross-platform database manager. In versions 7.1.8…8.8
• CVE-2026-48019Laravel is a web application framework. Prior to versions 12…8.9
• CVE-2026-4802A flaw was found in Cockpit. This vulnerability allows a rem…8
• CVE-2026-48021In epa4all, prior to version 2026-05-20, an attacker who can…9.1
• CVE-2026-48022@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wrec…6.5
• CVE-2026-48024Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-48025nebula-mesh is a self-hosted control plane for Slack Nebula …6.9
• CVE-2026-48026lakeFS is an open-source tool that transforms object storage…8.7
• CVE-2026-48027Nx Console is the user interface for Nx & Lerna. On 19 May 2…9.8