CVE-2026-40912

high
Published 2026-04-30 · Modified 2026-05-06
CVSS v3
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v2
VIR risk
8.2

Description

Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync

Predictions

Exploit likelihood
88%
Patch ETA

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/traefik/traefik/security/advisories/GHSA-6jwx-7vp4-9847

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/traefik/traefik/releases/tag/v3.6.14

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/traefik/traefik/releases/tag/v2.11.43

Package impact

EcosystemPackageVulnerableFixed
golang Gogithub.com/traefik/traefik/v3>=3.7.0-ea.1,<3.7.0-rc.23.7.0-rc.2
golang Gogithub.com/traefik/traefik/v3>=3.0.0-beta1,<3.6.143.6.14
golang Gogithub.com/traefik/traefik/v2<2.11.432.11.43
golang Gogithub.com/traefik/traefik<=1.7.34
golang GOgithub.com/traefik/traefik<= 1.7.34
golang GOgithub.com/traefik/traefik/v2< 2.11.432.11.43
golang GOgithub.com/traefik/traefik/v3>= 3.0.0-beta1, < 3.6.143.6.14
golang GOgithub.com/traefik/traefik/v3>= 3.7.0-ea.1, < 3.7.0-rc.23.7.0-rc.2

Application impact

VendorProductVersionsFixed
traefiktraefik{"endExcluding":"2.11.43"}2.11.43
traefiktraefik3.7.0

References

CWEs

CWE-706

Verify integrity in audit chain (admin only). AS-IS.