# CVE-2025-66490: traefik PrivEsc — Fixed in 2.11.32

🐹 Go

Not in CISA KEV

# CVE-2025-66490 — traefik

CVE-2025-66490 is a CWE-436 vulnerability in github.com/traefik/traefik. A fix is available for github.com/traefik/traefik — see the affected versions and patch details below.

Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules

Also known as[GHSA-gm3x-23wp-hc2c](/vulnerability/GHSA-gm3x-23wp-hc2c)GO-2025-4206

Published

Dec 9, 2025

Updated

Oct 28, 2026

Affected

3 pkgs

Patched

2 / 3

Exploits

None indexed

Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### Proof-of-concept exploit code exists

-   CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
-   CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66490.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.5%probability of exploitation in next 30 days

Lower Risk+0.03%

Lower risk than most CVEs41th percentile — riskier than 41% of all scored CVEsHighest risk

0.00%0.32%0.65%0.97%0.0%0.5%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

3 pkgs affected

🐹`github.com/traefik/traefik`🐹`github.com/traefik/traefik/v2`🐹`github.com/traefik/traefik/v3`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

### Impact

There is a potential vulnerability in Traefik managing the requests using a `PathPrefix`, `Path` or `PathRegex` matcher.

When Traefik is configured to route the requests to a backend using a matcher based on the path; if the request path contains an encoded restricted character from the following set **('/', '', 'Null', ';', '?', '#')**, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.

### Example

```
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-service
spec:
  routes:
    - match: PathPrefix(‘/admin/’)
      kind: Rule
      services:
        - name: service-a
          port: 8080
      middlewares:
        - name: my-security-middleware
    - match: PathPrefix(‘/’)
      kind: Rule
      services:
        - name: service-a
          port: 8080
```

In such a case, the request `http://mydomain.example.com/admin%2F` will reach the backend `service-a` without operating the middleware `my-security-middleware` and passing the security put in place for the `/admin/` path.

### Patches

-   [https://github.com/traefik/traefik/releases/tag/v2.11.32](https://github.com/traefik/traefik/releases/tag/v2.11.32)
-   [https://github.com/traefik/traefik/releases/tag/v3.6.4](https://github.com/traefik/traefik/releases/tag/v3.6.4)

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

<details> <summary>Original Description</summary>### Summary A vulnerability exists in Traefik’s path matching logic that allows attackers to bypass access-control middleware (e.g., blocking rules) by using URL-encoded paths. I found this vulnerability while playing PwnSec CTF 2025 with my team @0xL4ugh

#### Details

Traefik evaluates router rules before decoding or normalizing the request path, but forwards the request after decoding to the backend service. As a result, routes meant to block access to sensitive endpoints (such as internal, beta, or admin endpoints) can be trivially bypassed.

#### PoC

Traefik configuration used in this issue :

```
  entryPoints = ["web"]
  rule = "PathPrefix(`/report_note`)"
  priority = 10
  middlewares = ["block-access"]
  service = "flask-service"

[http.middlewares.block-access.replacePathRegex]
  regex = ".*"
  replacement = "/blocked"
```

The intention is to block all access to /report\_note.

However, the following request bypasses the block:

```
POST /%2freport_note HTTP/1.1
Host: localhost:62814


```

#### Impact

Access Control Bypass: Any endpoint intended to be blocked (e.g., admin/debug/beta APIs) can be accessed by URL-encoding slashes or other characters.

This could lead to:

-   Unauthorized access to restricted endpoints
-   Execution of protected internal functionality
-   Potential privilege escalation
-   Bypass of security policies enforced via Traefik routing rules

</details>

## Affected Packages

3 total 2 fixed

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`github.com/traefik/traefik` 

all versions

No fix

🐹Go

`github.com/traefik/traefik/v2` 

all versions

2.11.32`go get github.com/traefik/traefik/v2@v2.11.32`

🐹Go

`github.com/traefik/traefik/v3` 

all versions

3.6.3`go get github.com/traefik/traefik/v3@v3.6.3`

## Affected Products

1 product · 2 configurations

Application

`traefik`traefik

≥ 3.0.0 && < 3.6.3

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/traefik/traefik, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    A fix is available for CVE-2025-66490; check the affected-versions list above or the advisory for the patched release of github.com/traefik/traefik, then make sure no transitive dependency still pins the vulnerable range.
    
3.  ### Workarounds
    
    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
    

## Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

Workaround published by Red Hat

> Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Source: [Red Hat security advisory for CVE-2025-66490](https://access.redhat.com/security/cve/cve-2025-66490) (CC BY 4.0)

Product

Fixed in

Advisory

Red Hat OpenShift Dev Spaces (RHOSDS) 3.26

`devspaces/traefik-rhel9:1769638073`

[RHSA-2026:2456](https://access.redhat.com/errata/RHSA-2026:2456)

## Frequently Asked Questions

\## Impact There is a potential vulnerability in Traefik managing the requests using a \`PathPrefix\`, \`Path\` or \`PathRegex\` matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path; if the request path contains an encoded restricted character from the following set \*\*('/', '\\', 'Null', ';', '?', '#')\*\*, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. ## Example \`\`\`yaml apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: my-service spec: routes: - match: PathPrefix(‘/admin

O3 Security · Impact-Aware SCA

### Is CVE-2025-66490 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)