onyx

onyx --cves cve-2026-65600

CVE-2026-65600

MEDKEVTraefik
score
30.2
cvss
5.3
epss
0.6%
published
2026-07-22
kev added
2026-10-21
first seen

Traefik <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass caused by path traversal in ReplacePathRegex middleware forwarding unnormalized paths, letting unauthenticated remote attackers bypass authentication, exploit requires crafted requests with specific regex patterns.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-07-22 — PublishedP2026-10-21 — Added to CISA KEVK2026-10-21 — Tracked by OnyxTscore2026-10-21: score 30.230.2epss2026-09-22: epss 0.4%2026-09-23: epss 0.4%2026-09-24: epss 0.6%2026-09-25: epss 0.6%2026-09-26: epss 0.6%2026-09-27: epss 0.6%2026-09-29: epss 0.6%2026-09-30: epss 0.6%2026-10-01: epss 0.6%2026-10-02: epss 0.6%2026-10-03: epss 0.6%2026-10-04: epss 0.6%2026-10-05: epss 0.6%2026-10-06: epss 0.6%2026-10-07: epss 0.6%2026-10-08: epss 0.6%2026-10-09: epss 0.6%2026-10-10: epss 0.6%2026-10-11: epss 0.6%2026-10-12: epss 0.6%2026-10-13: epss 0.6%2026-10-14: epss 0.6%2026-10-15: epss 0.6%2026-10-16: epss 0.6%2026-10-18: epss 0.6%2026-10-19: epss 0.6%2026-10-20: epss 0.6%2026-10-21: epss 0.6%0.6%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Added to CISA KEV
  3. Tracked by Onyx

Weaknesses

CWE-22

References 3