Most recent entries from all

certfr-2026-avi-0785 — Une vulnérabilité a été découverte dans Traefik. Elle permet à un attaquant de provoquer un contournement de la politiq…

2026-10-04T03:46:04.043400+00:00

certfr-2026-avi-0785

EUVD-2026-329776

2026-10-04T03:46:04.043443+00:00

EUVD-2026-329776

fkie_cve-2026-54762

2026-10-04T03:46:04.043458+00:00

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency — a missing, malformed, unreadable, or policy-denied Secret — rather than an intentionally unprotected route. This vulnerability is fixed in 3.7.5.

GHSA-4mr2-fg2p-w63c — Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

2026-10-04T03:46:04.043513+00:00

Affected: Go: github.com/traefik/traefik/v3

## Summary

There is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported `nginx.ingress.kubernetes.io/auth-type` and `auth-secret` annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency — a missing, malformed, unreadable, or policy-denied Secret — rather than an intentionally unprotected route.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.5

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

Original Description

### Summary

Traefik's Kubernetes Ingress NGINX provider can fail open for routes that explicitly configure BasicAuth or DigestAuth through supported ingress-nginx annotations.

When an Ingress contains `nginx.ingress.kubernetes.io/auth-type: basic` or `digest`, but the referenced `nginx.ingress.kubernetes.io/auth-secret` cannot be resolved or parsed, Traefik logs the auth resolution error, skips inst…

openSUSE-SU-2026:11251-1 — traefik-3.7.7-1.1 on GA media

2026-10-04T03:46:04.043598+00:00

traefik-3.7.7-1.1 on GA media