CVE-2026-114636: Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the Kubernetes Ingress NGINX provider with ssl-passthrough Ingresses that are reachable through a non-TLS HTTP entry point are exposed. The affected Ingress must use access-control annotations such as auth-type, auth-url, or whitelist-source-range.
What does an attacker need to exploit this?
An unauthenticated attacker only needs network access to the HTTP entry point and the affected Ingress host. Exploitation does not require credentials or user interaction, although the attack complexity is rated high.
Are attempts to exploit this issue visible in Traefik logs?
No. Requests that bypass the affected access-control annotations are described as producing no logs.
What should be prioritized for remediation?
Upgrade affected Traefik v3.7.13 deployments to v3.7.14. Until then, prevent access to the affected non-TLS HTTP entry point for ssl-passthrough Ingress hosts.