Description
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| traefik | traefik | 3.7.13 – < 3.7.14 | 3.7.14 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | traefik | 3.7.16-1.1 | openSUSE-SU-2026:12281-1 |
Advisories 1
- openSUSE-SU-2026:12281-1 traefik-3.7.16-1.1 on GA media SUSE / openSUSE Security Updates · Oct 27, 2026
References
- GitHub Security Advisory (GHSA-qvj7-gq9c-hp7q) vendor-advisory
- VulnCheck Advisory: Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router third-party-advisory