CVE-2026-114636: Traefik Kubernetes Ingress Auth Bypass

CVE-2026-114636 Overview

CVE-2026-114636 is an access-control bypass in Traefik v3.7.13 affecting the Kubernetes Ingress NGINX provider. The HTTP router that Traefik generates for ssl-passthrough Ingresses on non-TLS entry points fails to apply the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends that administrators believed were protected by auth-type, auth-url, or whitelist-source-range annotations. The bypass produces no log entries, making exploitation silent. The flaw is categorized as Missing Authentication for Critical Function [CWE-306] and is fixed in Traefik v3.7.14.

Critical Impact

Unauthenticated network attackers can reach backend services behind Traefik that rely on NGINX Ingress annotations for authentication or IP allowlisting, with no audit trail of the bypass.

Affected Products

• Traefik v3.7.13
• Traefik Kubernetes Ingress NGINX provider
• ssl-passthrough Ingresses exposed on non-TLS HTTP entry points

Discovery Timeline

• 2026-10-22 - CVE-2026-114636 published to the National Vulnerability Database (NVD)
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114636

Vulnerability Analysis

Traefik supports NGINX Ingress annotations when running as a Kubernetes ingress controller, including authentication (nginx.ingress.kubernetes.io/auth-type, auth-url) and IP allowlisting (whitelist-source-range). For Ingresses that enable ssl-passthrough, Traefik also provisions a parallel HTTP router on non-TLS entry points to handle plain HTTP traffic that matches the Ingress host.

The generated HTTP router does not inherit the access-control middleware chain derived from the Ingress annotations. As a result, requests arriving on the HTTP entry point are forwarded directly to the backend. Protections that administrators configured through NGINX-style annotations are silently skipped. The missing enforcement also means no middleware logs the denied or allowed decision, so bypass attempts leave no trace in Traefik's access or middleware logs.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306] in the router-generation path for ssl-passthrough Ingresses. The code path that builds the auxiliary HTTP router does not attach the authentication, forward-auth, or IP allowlist middlewares that are attached to the TLS router. Access-control enforcement is coupled to the TLS router construction rather than to the Ingress definition itself.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to Traefik's non-TLS entry point using the Host header of a vulnerable ssl-passthrough Ingress. Traefik routes the request through the unprotected HTTP router and forwards it to the backend. No credentials, source-IP match, or forward-auth response is required. See the GitHub Security Advisory GHSA-qvj7-gq9c-hp7q and the VulnCheck Advisory: Traefik 3.7.13 Bypass for additional technical detail. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-114636

Indicators of Compromise

• Successful HTTP requests to backend services that should require authentication via auth-type or auth-url annotations, with no corresponding auth attempt in upstream logs.
• Backend application logs showing requests from source IPs outside configured whitelist-source-range CIDR blocks.
• Access to ssl-passthrough Ingress hostnames over plain HTTP (port 80) rather than HTTPS (port 443).

Detection Strategies

• Inventory all Kubernetes Ingress resources using nginx.ingress.kubernetes.io/ssl-passthrough: "true" combined with any auth-* or whitelist-source-range annotation.
• Correlate Traefik entry-point access logs with backend application auth logs to find requests that reached backends without matching authentication events.
• Replay test requests to ssl-passthrough hosts on the HTTP entry point and verify they are rejected after patching.

Monitoring Recommendations

• Alert on any non-TLS traffic to hostnames that are also served via ssl-passthrough.
• Monitor Traefik router configuration dumps for routers bound to the HTTP entry point that lack middleware chains.
• Forward Traefik access logs and backend auth logs into a central analytics platform for cross-source correlation.

How to Mitigate CVE-2026-114636

Immediate Actions Required

• Upgrade Traefik to v3.7.14 or later where the HTTP router for ssl-passthrough Ingresses enforces access-control annotations.
• Audit all ssl-passthrough Ingresses and confirm that intended authentication and IP allowlist controls are applied after the upgrade.
• Restrict exposure of the non-TLS entry point at the network boundary until the patch is deployed.

Patch Information

Traefik v3.7.14 contains the fix. Refer to the GitHub Security Advisory GHSA-qvj7-gq9c-hp7q for release notes and upgrade guidance.

Workarounds

• Disable the HTTP (non-TLS) entry point on Traefik instances that serve ssl-passthrough Ingresses, or redirect all port 80 traffic to port 443 at an upstream load balancer.
• Remove ssl-passthrough from affected Ingresses and terminate TLS at Traefik so standard middleware chains apply.
• Enforce authentication and IP allowlisting at the backend application layer rather than relying solely on Ingress annotations.

# Example: redirect all HTTP traffic to HTTPS at the Traefik entry point
# traefik.yml static configuration
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address: ":443"