CVE-2025-66490 — traefik
CVE-2025-66490 is a CWE-436 vulnerability in github.com/traefik/traefik. A fix is available for github.com/traefik/traefik — see the affected versions and patch details below.
Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66490.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
github.com/traefik/traefik🐹github.com/traefik/traefik/v2🐹github.com/traefik/traefik/v3Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher.
When Traefik is configured to route the requests to a backend using a matcher based on the path; if the request path contains an encoded restricted character from the following set ('/', '', 'Null', ';', '?', '#'), it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.
Example
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: my-service
spec:
routes:
- match: PathPrefix(‘/admin/’)
kind: Rule
services:
- name: service-a
port: 8080
middlewares:
- name: my-security-middleware
- match: PathPrefix(‘/’)
kind: Rule
services:
- name: service-a
port: 8080
In such a case, the request http://mydomain.example.com/admin%2F will reach the backend service-a without operating the middleware my-security-middleware and passing the security put in place for the /admin/ path.
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.32
- https://github.com/traefik/traefik/releases/tag/v3.6.4
For more information
If you have any questions or comments about this advisory, please open an issue.
<details> <summary>Original Description</summary>### Summary A vulnerability exists in Traefik’s path matching logic that allows attackers to bypass access-control middleware (e.g., blocking rules) by using URL-encoded paths. I found this vulnerability while playing PwnSec CTF 2025 with my team @0xL4ughDetails
Traefik evaluates router rules before decoding or normalizing the request path, but forwards the request after decoding to the backend service. As a result, routes meant to block access to sensitive endpoints (such as internal, beta, or admin endpoints) can be trivially bypassed.
PoC
Traefik configuration used in this issue :
entryPoints = ["web"]
rule = "PathPrefix(`/report_note`)"
priority = 10
middlewares = ["block-access"]
service = "flask-service"
[http.middlewares.block-access.replacePathRegex]
regex = ".*"
replacement = "/blocked"
The intention is to block all access to /report_note.
However, the following request bypasses the block:
POST /%2freport_note HTTP/1.1
Host: localhost:62814
Impact
Access Control Bypass: Any endpoint intended to be blocked (e.g., admin/debug/beta APIs) can be accessed by URL-encoding slashes or other characters.
This could lead to:
- Unauthorized access to restricted endpoints
- Execution of protected internal functionality
- Potential privilege escalation
- Bypass of security policies enforced via Traefik routing rules
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/traefik/traefik | all versions | No fix |
| 🐹Go | github.com/traefik/traefik/v2 | all versions | 2.11.32go get github.com/traefik/traefik/v2@v2.11.32 |
| 🐹Go | github.com/traefik/traefik/v3 | all versions | 3.6.3go get github.com/traefik/traefik/v3@v3.6.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/traefik/traefik, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
No patched version of github.com/traefik/traefik has shipped for CVE-2025-66490 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2025-66490 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2025-66490. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 | devspaces/traefik-rhel9:1769638073 | RHSA-2026:2456 |
Frequently Asked Questions
Is CVE-2025-66490 in your dependencies?
O3 Security finds CVE-2025-66490 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.