Traefik Kubernetes Provider Authentication Bypass

Traefik (versions v3.7.0 through v3.7.11) contains a vulnerability in its Kubernetes ingress-nginx provider that enables an attacker to bypass critical middleware, including authentication (e.g., BasicAuth) and source-IP allowlisting. The issue arises when an Ingress resource is configured with both an authentication annotation and the 'nginx.ingress.kubernetes.io/from-to-www-redirect' annotation.

Under these conditions, the Traefik provider creates a 'sibling' router that matches based on the host alone. By crafting an HTTP request containing a non-numeric or empty port within the 'Host' header (e.g., 'Host: www.example.com:x'), an attacker can cause the load balancer to select this sibling router instead of the intended parent. Because the RedirectRegex middleware used in the redirection pattern is non-terminal, requests that do not trigger a redirect are forwarded directly to the backend without any security middlewares applied. This allows unauthorized access to services intended to be protected by Traefik. The vulnerability is resolved in Traefik v3.7.12.

Impact

Successful exploitation allows an unauthenticated attacker to bypass access controls and security policies on protected backend services. This exposes sensitive internal APIs or applications to unauthorized interaction, potentially leading to full system compromise depending on the backend service's own security posture.

Recommendation

• Upgrade Traefik to v3.7.12 or later immediately to resolve the insecure router creation logic.
• Audit existing Ingress configurations for the simultaneous presence of authentication annotations and 'nginx.ingress.kubernetes.io/from-to-www-redirect' for any services exposed via the Kubernetes provider.
• Monitor webserver access logs for anomalous 'Host' headers containing non-numeric port suffixes that may indicate an attempt to probe for this bypass.