Traefik (V3.2.0-V3.7.13) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/traefik-v3.2.0-v3.7.13/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 03:52:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTraefik: Access-control bypass in Kubernetes Ingress NGINX provider (CVE-2026-114636)https://feed.craftedsignal.io/briefs/2026-10-traefik-access-control-bypass/Thu, 22 Oct 2026 03:52:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-traefik-access-control-bypass/Traefik versions prior to 3.7.14 contain an access-control bypass vulnerability in the Kubernetes Ingress NGINX provider that allows unauthenticated access to backends protected by security annotations.Traefik versions prior to 3.7.14 are susceptible to an access-control bypass vulnerability within the Kubernetes Ingress NGINX provider. The vulnerability occurs when an ssl-passthrough Ingress is configured on a non-TLS entry point, causing Traefik to fail to apply critical access-control annotations. Specifically, protections defined via auth-type, auth-url, or whitelist-source-range are ignored. Unauthenticated remote attackers who can reach the HTTP entry point and identify the Ingress host can bypass intended security restrictions to access protected backend services. Exploitation of this vulnerability does not generate logs within the affected Traefik components.

Impact

Successful exploitation allows unauthenticated attackers to bypass authentication and authorization controls, potentially gaining unauthorized access to internal services or applications protected by Traefik Ingress annotations.

Recommendation

  • Upgrade Traefik to version 3.7.14 or later immediately.
  • Audit existing Ingress configurations for ssl-passthrough settings on non-TLS entry points to determine if they utilize auth-type, auth-url, or whitelist-source-range annotations.
  • Until patching is complete, restrict network access to the affected Traefik HTTP entry points to authorized sources only at the network or cloud infrastructure layer.
]]>highadvisoryingresskubernetesaccess-controlcve-2026-114636authentication-bypasswebservertraefik