{"vulnerability": "cve-2026-67309", "sightings": [{"uuid": "8240440a-c2c1-4cbd-b8b2-92517ffa46f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67309", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3ms47yxells24", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-67309 \u0432 Traefik: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043e\u0442 \u0430\u0442\u0430\u043a \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0443\u0442\u0438\n\n\n\nhttps://kripta.biz/posts/64A743C1-1992-45D9-9F66-CA3B5DCB8268", "creation_timestamp": "2026-08-02T14:46:50.190422Z"}, {"uuid": "85277dd2-5654-4199-b11f-72ddc52ecc36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67309", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-8rxv-jg7p-wvg3", "content": "", "creation_timestamp": "2026-08-06T18:35:08.901133Z"}, {"uuid": "f5bf5ac8-e48b-491d-b00a-c9e05dbf5c1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67309", "type": "seen", "source": "https://gist.github.com/alon710/73aecb4bf7a9c9303fe6451f784d95ea", "content": "# CVE-2026-67309: CVE-2026-67309: Path Traversal and Authentication Bypass in Traefik RewriteTarget Middleware\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67309\n\n## Summary\nA high-severity path traversal vulnerability exists in Traefik's Kubernetes Ingress NGINX provider. The flaw resides in the RewriteTarget middleware, which is auto-generated when an Ingress resource specifies the `nginx.ingress.kubernetes.io/rewrite-target` annotation. This allows remote, unauthenticated attackers to bypass route-level authentication and access restricted downstream endpoints by exploiting a parser differential.\n\n## TL;DR\nUnauthenticated remote attackers can bypass Traefik's routing-layer security controls via relative dot-segment path traversals, gaining unauthorized access to restricted downstream backend resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0**: 7.8 (High)\n- **EPSS Score**: 0.00492\n- **Exploit Status**: PoC (No Weaponized)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Traefik Proxy (Kubernetes Ingress NGINX provider environment with RewriteTarget enabled)\n- **Traefik**: >= v3.7.0, <= v3.7.7 (Fixed in: `v3.7.8`)\n\n## Mitigation\n\n- Upgrade Traefik to v3.7.8 or higher.\n- Enforce strict Ingress path regular expression matching by requiring trailing slashes.\n- Implement downstream validation rules to reject unnormalized URI segments.\n\n**Remediation Steps:**\n1. Identify all Kubernetes Ingress resources utilizing 'nginx.ingress.kubernetes.io/rewrite-target' or custom regex path replacement.\n2. Audit matching rules to ensure wildcards are separated by explicit directory boundaries (e.g., '/api/(.*)').\n3. Deploy Traefik v3.7.8 using Helm, YAML manifests, or the official Docker image update.\n4. Verify incoming logs for HTTP 400 responses indicating rejected path traversal attempts.\n\n## References\n\n- [GitHub Security Advisory GHSA-8rxv-jg7p-wvg3](https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/traefik-path-traversal-via-rewritetarget-authentication-bypass)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67309) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T19:32:23.703855Z"}]}