Homepage

Authentication Bypass Affecting traefik-2 package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.59% (44th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-TRAEFIK2-17331315
  • published13 Jun 2026
  • disclosed23 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 13 Jun 2026

NewCVE-2026-48020  (opens in a new tab)
CWE-288  (opens in a new tab)

How to fix?

There is no fixed version for Minimos:latest traefik-2.

NVD Description

Note: Versions mentioned in the description apply only to the upstream traefik-2 package and not the traefik-2 package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.