Authentication Bypass in Traefik HTTP Reverse Proxy and Load Balancer

CVE-2026-88877

What is CVE-2026-88877?

Traefik versions 3.7.0 through 3.7.11 exhibit a vulnerability wherein the ingress-nginx provider incorrectly handles Ingresses with specific annotations. This flaw can lead to the creation of an unintended sibling router which lacks necessary authentication middleware. When requests are made to the backend with non-standard host formats, the system fails to apply critical protections like BasicAuth and source-IP allowlisting, ultimately exposing sensitive services. This issue has been resolved in Traefik version 3.7.12.

References