CVE-2026-40912

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This authentication bypass vulnerability allows an unauthenticated attacker to access protected content. The flaw occurs when the StripPrefixRegex middleware is used with authentication mechanisms such as ForwardAuth, BasicAuth, or DigestAuth. By crafting a specific URL with dot-segments, an attacker can bypass authentication checks and gain unauthorized access to sensitive resources.