Traefik accepts a rootless HTTP/1 request-target where Go stores the value in URL.Opaque with an empty URL.Path. rewriteRequestBuilder enforces routing, path sanitization, forwardAuth, encoded character checks, and access logging against a normalized /, but forwards URL.Opaque verbatim, enabling cross-vhost routing bypass, path-scoped auth bypass, and access-log evasion. Affected: traefik < 2.11.57, >= 3.0.0 < 3.7.13. Upgrade to 2.11.57/3.7.13.