Traefik CVE-2026-114636

Exploitation requires a specific deployment: Traefik v3.7.13 (before v3.7.14) using the Kubernetes Ingress NGINX provider, with an ssl-passthrough Ingress whose backend relies on auth-type, auth-url, or whitelist-source-range annotations for protection, AND a non-TLS (plain HTTP) entry point exposed and reachable by the attacker. The attacker must also know or supply the correct Ingress host. Limiting factors: the flaw only manifests on the HTTP (non-TLS) router generated for ssl-passthrough Ingresses - deployments without ssl-passthrough, without a non-TLS entry point, or not using the Ingress NGINX provider are not affected. No authentication or user interaction is required once these conditions are met (PR:N/UI:N), and the bypass is not logged, hindering detection.

This is a genuine access-control bypass (CWE-306) rather than a high-CVSS-but-low-impact issue, but its real-world priority is strongly gated by configuration rather than being broadly exploitable. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated access with no user interaction - but critically sets AT:P (attack requirements present), reflecting that the vulnerable deployment path (ssl-passthrough Ingress exposed on a non-TLS entry point) must exist. Note the impact split: the vulnerable system (Traefik itself) shows VC:N/VI:N/VA:N while subsequent systems score SC:H/SI:H - the damage is entirely downstream, where protected backends become reachable. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability signals are absent; per the data, there is no public exploit identified at time of analysis and no evidence of active exploitation. The aggravating factor is stealth: the advisory states nothing is logged, meaning bypass attempts leave no trail and defenders cannot easily detect or retrospectively confirm compromise. For organizations running the affected Traefik build with this exact Ingress NGINX / ssl-passthrough configuration, this is a high-priority patch; for everyone else it is not reachable. The reported CVSS of 7.0 (High) is consistent with the vendor 4.0 vector.

An organization runs Traefik v3.7.13 as a Kubernetes ingress with the Ingress NGINX provider, and has an ssl-passthrough Ingress whose backend is protected by auth-url/auth-type or whitelist-source-range annotations, while also exposing a plain HTTP (non-TLS) entry point. An unauthenticated attacker on the network sends an HTTP request carrying the Ingress host header and is routed straight to the protected backend because the generated HTTP router silently omits the access-control annotations, with no log entry generated. No public exploit code was provided in the input, so this scenario is inferred from the advisory rather than a published POC.