https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:23:06 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0785 certfr-2026-avi-0785 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0785 https://cve.radiocsirt.org/vuln/euvd-2026-329776 EUVD-2026-329776 https://cve.radiocsirt.org/vuln/euvd-2026-329776 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54762 <p>Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik&#39;s Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency — a missing, malformed, unreadable, or policy-denied Secret — rather than an intentionally unprotected route. This vulnerability is fixed in 3.7.5.</p> <p>Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik&#39;s Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency — a missing, malformed, unreadable, or policy-denied Secret — rather than an intentionally unprotected route. This vulnerability is fixed in 3.7.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54762 https://cve.radiocsirt.org/vuln/ghsa-4mr2-fg2p-w63c <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v3</p> <p>## Summary</p> <p>There is a medium severity vulnerability in Traefik&#39;s Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported `nginx.ingress.kubernetes.io/auth-type` and `auth-secret` annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency — a missing, malformed, unreadable, or policy-denied Secret — rather than an intentionally unprotected route.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v3.7.5</p> <p>## For more information</p> <p>If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>### Summary</p> <p>Traefik&#39;s Kubernetes Ingress NGINX provider can fail open for routes that explicitly configure BasicAuth or DigestAuth through supported ingress-nginx annotations.</p> <p>When an Ingress contains `nginx.ingress.kubernetes.io/auth-type: basic` or `digest`, but the referenced `nginx.ingress.kubernetes.io/auth-secret` cannot be resolved or parsed, Traefik logs the auth resolution error, skips inst…</p> <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v3</p> <p>## Summary</p> <p>There is a medium severity vulnerability in Traefik&#39;s Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported `nginx.ingress.kubernetes.io/auth-type` and `auth-secret` annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency — a missing, malformed, unreadable, or policy-denied Secret — rather than an intentionally unprotected route.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v3.7.5</p> <p>## For more information</p> <p>If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>### Summary</p> <p>Traefik&#39;s Kubernetes Ingress NGINX provider can fail open for routes that explicitly configure BasicAuth or DigestAuth through supported ingress-nginx annotations.</p> <p>When an Ingress contains `nginx.ingress.kubernetes.io/auth-type: basic` or `digest`, but the referenced `nginx.ingress.kubernetes.io/auth-secret` cannot be resolved or parsed, Traefik logs the auth resolution error, skips inst…</p> https://cve.radiocsirt.org/vuln/ghsa-4mr2-fg2p-w63c https://cve.radiocsirt.org/vuln/opensuse-su-2026:11251-1 <p>traefik-3.7.7-1.1 on GA media</p> <p>traefik-3.7.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11251-1