GHSA-8rxv-jg7p-wvg3 Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
SummaryThere is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the `nginx.ingress.kubernetes.io/rewrite-target` annotation with a regular expression that captures attacker-controlled text without requiring a path separator (for example path `/api(.*)` with rewrite target `/$1`), the generated `RewriteTarget` middleware can turn an initially safe request path into a dot-segment traversal path after the router has already been selected.Patcheshttps://github.com/traefik/traefik/releases/tag/v3.7.8For more informationIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).SummaryTraefik's Kubernetes Ingress NGINX provider creates an internal `RewriteTarget` middleware for the `nginx.ingress.kubernetes.io/rewrite-target` annotation. When an Ingress path captures attacker-controlled text without requiring a path separator, the middleware can turn an initially safe path into a dot-segment traversal path after Traefik has already selected the router.For example, with Ingress path `/api(.*)` and rewrite target `/$1`, an unauthenticated request to `/api../admin` follows this flow:The default entry-point path sanitizer leaves `/api../admin` unchanged because `api..` is one ordinary segment.The public router's `PathRegexp("(?i)^/api(.*)")` rule matches.`RewriteTarget` captures `../admin` and creates `/../admin`.The middleware forwards `/../admin` without checking whether path normalization changes it.A backend that normalizes paths resolves `/../admin` to `/admin`.The request reaches content intended to be reachable only through a separate `/admin` router with BasicAuth, DigestAuth, or ForwardAuth.This is an unpatched sibling of [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv), which added post-replacement normalization validation to `ReplacePathRegex`. The separate ingress-nginx `RewriteTarget` implementation did not receive the same validation. The bypass remains exploitable in the patched Traefik v3.7.7 release.Severity**Proposed severity:** Critical**CVSS 3.1:** 9.1 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`Attack vector: NetworkAttack complexity: Low once the affected routing pattern existsPrivileges required: NoneUser interaction: NoneScope: UnchangedConfidentiality: HighIntegrity: HighAvailability: None**Primary weakness:** CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)**Secondary weakness:** CWE-288 — Authentication Bypass Using an Alternate Path or ChannelThe practical impact depends on the protected backend paths. If they are read-only or low sensitivity, environmental severity may be lower.Exploitation PreconditionsThe Kubernetes Ingress NGINX provider is enabled.A public Ingress uses `rewrite-target` with a regex that can capture `..` adjacent to the matched prefix, such as `/api(.*)` with `/$1`.A protected router exposes another path on the same backend, such as `/admin`, and relies on a Traefik authentication or authorization middleware.The backend normalizes dot segments before dispatching the request.These are deployment prerequisites; the remote attacker needs no credentials or special timing.Affected ComponentsConfirmed versionsTraefik v3.7.0 through v3.7.7Current `master` at commit `b93f02cd07b79490fb8c8f02e301a7a1ec553195`Current `v3.7` branch at `69259c3acc9d4bdc065cb2e3b83336f7de3e7038`The vulnerable middleware is present in every stable v3.7 release checked. The v2.11 and v3.6 branches do not contain this ingress-nginx `RewriteTarget` implementation.Code locations`pkg/provider/kubernetes/ingress-nginx/middleware.go:257-274`Converts the Ingress path and `rewrite-target` annotation directly into `dynamic.RewriteTarget` configuration.`pkg/middlewares/ingressnginx/rewritetarget/rewrite_target.go:85-157`Performs capture-based path rewriting and forwards the rewritten path without normalization validation.`pkg/server/middleware/middlewares.go:346-353`Instantiates the vulnerable middleware in the live HTTP chain.Root CauseThe provider passes the route regex and annotation replacement into the middleware:`RewriteTarget.ServeHTTP` then derives a path from attacker-controlled capture groups:There is no invariant check between `PathUnescape` and forwarding to ensure that `req.URL.Path` equals its normalized form. Because routing happens before middlewares execute, any protected router that would match the normalized result is never reconsidered.The core `ReplacePathRegex` middleware now enforces this invariant by calling `req.URL.JoinPath()` and returning HTTP 400 when normalization changes the replacement. `RewriteTarget` implements equivalent capture-based behavior but lacks that check.Default `entryPoints.<name>.http.sanitizePath=true` does not prevent this issue. Sanitization occurs before routing and before `RewriteTarget` creates the traversal sequence.ImpactAn unauthenticated network attacker can bypass route-level authentication or authorization and access protected paths on the backend. Depending on the protected API, this can allow:reading administrative or sensitive data;invoking privileged state-changing endpoints with GET, POST, PUT, PATCH, or DELETE;bypassing BasicAuth, DigestAuth, ForwardAuth, IP restrictions, or other controls attached only to the protected router;crossing intended public/protected path boundaries with one HTTP request.The middleware is method-agnostic, so the issue is not limited to read-only requests.Proof of ConceptValidation EnvironmentTraefik v3.7.7 official Linux amd64 releaseRelease archive SHA-256 verified as `5c8ff19144683f862c04e8ac01893e8cd94a3519d3d9ca3e6fbd0a7de73261ba`Default `sanitizePath=true`Node.js v24 backendKubernetes Ingress NGINX provider fed valid Ingress, Service, EndpointSlice, and Secret objects through a local Kubernetes API fixtureNo Traefik source files were modified.1. Create the normalizing backendSave as `backend.js`:Run it:2. Apply the Kubernetes objectsThe `ExternalName` service makes an externally run Traefik process connect to the local backend. If Traefik runs inside the cluster, replace it with a normal Deployment and ClusterIP Service.3. Run unmodified Traefik v3.7.7Traefik generates the following relevant dynamic configuration:The protected router separately contains a BasicAuth middleware and a `PathRegexp("(?i)^/admin")` rule.4. Confirm authentication is enforcedObserved:5. Exploit the traversal rewritePlain variant:Observed:Percent-encoded variant:Observed:The direct request receives 401, while both unauthenticated traversal requests receive the protected content with status 200.RemediationApply the same post-rewrite normalization invariant used by the patched `ReplacePathRegex` middleware. After decoding `RawPath`, normalize a copy and reject the request if normalization changes `Path`:Recommended additional actions:Centralize the post-transformation path validation used by `ReplacePathRegex`, `StripPrefix`, `StripPrefixRegex`, and ingress-nginx `RewriteTarget` to prevent future drift.Add regression tests for `/api../admin` and `/api%2e%2e/admin`, expecting HTTP 400.Test both `URL.Path` and `URL.RawPath` cases and preserve legitimate encoded-path behavior.Audit the ingress-nginx snippet `rewrite` implementation for the same post-rewrite invariant.Temporary MitigationUse a regex that requires a separator or end-of-path before captured user data, for example:This prevents `/api../admin` from matching. Also enforce authentication in the backend rather than relying exclusively on separate Traefik path routers. Entry-point `sanitizePath=true` alone is not a mitigation because the dangerous dot segment is created after sanitization.Duplicate CheckAs of 2026-07-09:Traefik's public security advisories contain no entry mentioning `RewriteTarget` or ingress-nginx `rewrite-target` path traversal.Public issue and pull-request searches found no report for this path-normalization bypass.GHSA-cxjq-mrr5-89rv is related but not a duplicate: it fixes `pkg/middlewares/replacepathregex`, while this report affects `pkg/middlewares/ingressnginx/rewritetarget` and reproduces on the version that contains that fix, v3.7.7.DisclosureIf confirmed, could you please create a GitHub Security Advisory and request a CVE? I am happy to validate a patch and coordinate disclosure.
CVSS v4.0 score: 7.8