Access Control Bypass in Traefik's Kubernetes Ingress NGINX Provider
CVE-2026-114636

7HIGH

Key Information:

Vendor

Traefik

Status
Traefik
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114636?

An access-control bypass vulnerability exists in Traefik versions prior to v3.7.14, specifically within the Kubernetes Ingress NGINX provider. The issue arises when SSL passthrough is utilized; the HTTP router fails to enforce access-control annotations defined in the Ingress. Consequently, unauthenticated attackers may exploit non-TLS entry points, gaining unauthorized access to backends that are supposed to be protected by specified authentication mechanisms. This vulnerability lacks proper logging, which exacerbates the risk as intrusion attempts could go unnoticed.

Affected Version(s)

traefik 3.7.13 < 3.7.14

traefik 3.7.14

References

https://github.com/traefik/traefik/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/traefik-3.7.13-authe...
third-party-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.