Traefik HTTP/1 Rootless Request-Target Bypass in Path-Scoped Routing

The GitHub Security Advisory database has published a high-severity issue affecting Traefik versions v3.0 through v3.6, which are end-of-life, and v3.7 up to v3.7.12. The vulnerability involves handling HTTP/1.x requests with rootless or opaque request-targets. When such requests are parsed, Traefik evaluates routing, middleware, and access logging decisions against a normalized path of "/", while forwarding the original request-target verbatim to the backend. This behavior bypasses path-scoped routing, middleware guards, and access logging mechanisms, potentially enabling cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion.

Patches addressing this issue are available in versions v2.11.57 and v3.7.13. Operators using affected versions must upgrade to these patched releases to mitigate the vulnerability. Notably, users on end-of-life versions v3.0 through v3.6 must upgrade to v3.7.13, as those versions will not receive independent fixes.

Before upgrading, operators should verify whether their backends interpret rootless request-targets as paths. If so, this vulnerability could have already exposed sensitive routes or bypassed middleware protections. Additionally, reviewing access logs for unexpected "GET / HTTP/1.1" entries may help identify potential exploitation attempts. This issue highlights the importance of scrutinizing default configurations and path normalization behavior in HTTP proxies.