CVE-2026-54762: Traefik Auth Bypass Vulnerability

CVE-2026-54762 Overview

CVE-2026-54762 is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. The flaw affects Traefik versions 3.7.0-ea.1 through 3.7.4. When an Ingress enables BasicAuth or DigestAuth through the nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the error, skips installing the authentication middleware, and still publishes the router to the backend service. Routes that operators intended to protect become reachable without authentication. The issue is fixed in Traefik 3.7.5.

Critical Impact
Backend services intended to be protected by HTTP authentication are exposed to unauthenticated clients whenever the referenced Kubernetes Secret is missing, malformed, unreadable, or denied by policy.

Affected Products

Traefik 3.7.0-ea.1 through 3.7.4
Deployments using the Kubernetes Ingress NGINX provider
Ingress resources configured with nginx.ingress.kubernetes.io/auth-type set to basic or digest

Discovery Timeline

2026-06-23 - CVE-2026-54762 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54762

Vulnerability Analysis

The vulnerability is categorized under [CWE-636] Not Failing Securely (Failing Open). Traefik's Kubernetes Ingress NGINX provider processes annotations on Ingress resources to determine which middlewares to attach to a generated router. When operators set nginx.ingress.kubernetes.io/auth-type to basic or digest, Traefik must resolve the referenced Secret via the nginx.ingress.kubernetes.io/auth-secret annotation and load the credential list before installing the authentication middleware on the route.

In affected versions, the provider treats Secret resolution failures as a soft error. If the Secret is missing, malformed, unreadable due to RBAC restrictions, or denied by an admission policy, Traefik logs the resolution error and continues building the route without the authentication middleware. The resulting router is then emitted to the data plane and serves traffic to the backend with no credential check.

Root Cause

The root cause is a logic flaw in dependency handling. The provider decouples middleware construction from route emission, so a failure to construct a security-critical middleware does not abort or quarantine the route. The secure default would be to refuse to publish a route whose declared protection cannot be installed, or to install a deny-by-default middleware as a placeholder.

Attack Vector

Exploitation does not require crafting a network payload. An attacker who can disrupt or prevent Secret resolution, for example by deleting the Secret, renaming it, applying a policy that blocks read access, or introducing a parsing error, can cause the protected route to publish without authentication. Any client able to reach the Traefik data plane can then request the backend without credentials. The condition can also occur unintentionally during cluster operations such as Secret rotation, GitOps reconciliation errors, or namespace migrations.

No public proof-of-concept exploit is referenced in the advisory, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the GitHub Security Advisory GHSA-4mr2-fg2p-w63c for upstream technical detail.

Detection Methods for CVE-2026-54762

Indicators of Compromise

Traefik logs showing Secret resolution or parsing errors for Ingress resources that declare nginx.ingress.kubernetes.io/auth-type
Successful HTTP 200 responses on backend routes that should return 401 Unauthorized when accessed without credentials
Audit log entries showing deletion, modification, or RBAC denial events for Secrets referenced by auth-secret annotations

Detection Strategies

Periodically probe Ingress endpoints annotated with auth-type: basic or auth-type: digest and alert when the response is not 401 for unauthenticated requests
Parse Traefik provider logs for messages indicating that an auth Secret could not be resolved, then correlate to the affected router and host
Reconcile cluster state by listing all Ingresses with auth annotations and verifying that each referenced Secret exists, is parseable, and is readable by the Traefik service account

Monitoring Recommendations

Forward Traefik and Kubernetes API audit logs to a centralized SIEM or data lake and build a detection on auth Secret resolution failures
Alert on unauthenticated 2xx responses to hosts that are tagged as authentication-protected in your Ingress inventory
Track changes to Secrets referenced by nginx.ingress.kubernetes.io/auth-secret and to the RBAC bindings of the Traefik controller service account

How to Mitigate CVE-2026-54762

Immediate Actions Required

Upgrade Traefik to version 3.7.5 or later in all clusters using the Kubernetes Ingress NGINX provider
Inventory every Ingress that declares nginx.ingress.kubernetes.io/auth-type and verify the referenced Secret exists, parses correctly, and is readable by the Traefik service account
Test each protected route with an unauthenticated request and confirm a 401 response before considering remediation complete

Patch Information

The fix is shipped in Traefik 3.7.5. Release notes and source changes are documented in the Traefik v3.7.5 release. Operators should follow their standard rollout process for the Traefik DaemonSet or Deployment and validate that ingress routing remains functional after the upgrade.

Workarounds

Where upgrade is not immediately possible, place an external authentication layer such as a service mesh policy or network policy in front of routes that rely on BasicAuth or DigestAuth annotations
Restrict write access to Secrets referenced by auth-secret annotations so that operational errors cannot remove them, and pin Secret names in GitOps to prevent accidental drift
Add synthetic monitoring that fails the deployment pipeline if a protected Ingress responds to unauthenticated requests with anything other than 401

bash

# Identify Ingresses that depend on the vulnerable annotation pattern
kubectl get ingress --all-namespaces -o json \
  | jq -r '.items[] | select(.metadata.annotations["nginx.ingress.kubernetes.io/auth-type"]) \
      | "\(.metadata.namespace)/\(.metadata.name) -> secret:\(.metadata.annotations["nginx.ingress.kubernetes.io/auth-secret"])"'

# Verify each referenced Secret exists and is readable by the Traefik service account
kubectl auth can-i get secret <secret-name> \
  --as=system:serviceaccount:<traefik-namespace>:<traefik-sa> -n <namespace>