{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/traefik-v3.2.0-v3.7.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-114636"},{"id":"CVE-2026-114637"},{"id":"CVE-2026-114642"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Traefik (\u003c 3.7.14)","Traefik (v3.2.0-v3.7.13)","Traefik (2.11.0 \u003c= 2.11.57)","Traefik (3.0.0 \u003c= 3.7.13)"],"_cs_severities":["high"],"_cs_tags":["ingress","kubernetes","access-control","cve-2026-114636","authentication-bypass","webserver","traefik"],"_cs_type":"advisory","_cs_vendors":["Traefik Labs"],"content_html":"\u003cp\u003eTraefik versions prior to 3.7.14 are susceptible to an access-control bypass vulnerability within the Kubernetes Ingress NGINX provider. The vulnerability occurs when an ssl-passthrough Ingress is configured on a non-TLS entry point, causing Traefik to fail to apply critical access-control annotations. Specifically, protections defined via auth-type, auth-url, or whitelist-source-range are ignored. Unauthenticated remote attackers who can reach the HTTP entry point and identify the Ingress host can bypass intended security restrictions to access protected backend services. Exploitation of this vulnerability does not generate logs within the affected Traefik components.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to bypass authentication and authorization controls, potentially gaining unauthorized access to internal services or applications protected by Traefik Ingress annotations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Traefik to version 3.7.14 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing Ingress configurations for ssl-passthrough settings on non-TLS entry points to determine if they utilize auth-type, auth-url, or whitelist-source-range annotations.\u003c/li\u003e\n\u003cli\u003eUntil patching is complete, restrict network access to the affected Traefik HTTP entry points to authorized sources only at the network or cloud infrastructure layer.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T03:52:43Z","date_published":"2026-10-22T03:52:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-traefik-access-control-bypass/","summary":"Traefik versions prior to 3.7.14 contain an access-control bypass vulnerability in the Kubernetes Ingress NGINX provider that allows unauthenticated access to backends protected by security annotations.","title":"Traefik: Access-control bypass in Kubernetes Ingress NGINX provider (CVE-2026-114636)","url":"https://feed.craftedsignal.io/briefs/2026-10-traefik-access-control-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Traefik (V3.2.0-V3.7.13)","version":"https://jsonfeed.org/version/1.1"}