EUVD-2026-75427
GHSA-9rch-gvf7-hrfc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Traefik 3.7.x ingress-nginx endpoint
-
DeliveryLocate Ingress with auth + www-redirect annotations
-
ExploitSend request with non-numeric port authority
-
ExecutionSibling router bypasses RedirectRegex
-
PersistReach protected backend without middleware
-
ImpactAccess protected service unauthenticated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a Kubernetes deployment using Traefik v3.7.0-v3.7.11 with the ingress-nginx provider, and specifically an Ingress that simultaneously carries an authentication annotation (e.g. BasicAuth) and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation - this exact annotation pair is what generates the vulnerable sibling router. The attacker then sends a request whose authority contains a non-numeric or empty port (for example 'Host: www.example.com:x') so it matches the host-only router but misses the numeric-port redirect pattern. Limiting factors: the vulnerable annotation combination is non-default and configuration-specific, and Traefik v2 and pre-3.7.0 v3 are not affected; where present, no authentication or user interaction is needed and it is remotely exploitable. |
| Impact | The CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, unauthenticated, low-complexity bypass with high impact on the protected backend - a genuine priority where the vulnerable configuration exists. The meaningful limiter is not attack difficulty but deployment: exploitation requires an Ingress that both uses the ingress-nginx provider and combines an auth annotation with from-to-www-redirect, which is a specific, non-default combination. No EPSS score, KEV entry, or public POC is provided, so there is no evidence of active exploitation; risk is currently theoretical-but-high given how easy the crafted request is (a single Host header manipulation) once a matching Ingress is present. Net: treat as high priority for anyone running Traefik 3.7.x as an ingress-nginx-compatible controller, lower urgency for deployments not using that provider or that annotation pair. |
| Exploit ScenarioDerived | An attacker identifies a Traefik 3.7.x ingress-nginx deployment fronting a BasicAuth-protected admin service that also has a www redirect annotation. They send an ordinary HTTP request to the backend's host but set the authority to 'Host: www.example.com:x', causing Traefik to select the sibling router, skip the RedirectRegex, and proxy the request straight to the protected backend with no authentication or source-IP allowlist applied. The attacker thereby reaches the protected service unauthenticated; no exploit tooling is required beyond a crafted Host header. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes backends when an Ingress uses the ingress-nginx compatibility provider with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a host-only 'sibling' router carrying only a non-terminal RedirectRegex middleware that still routes to the protected backend, so a crafted request evades the redirect and is proxied without any annotation-derived middleware. Reported by VulnCheck with a published advisory; no public exploit is identified at time of analysis, though the technique is fully documented and trivially reproducible.
RemediationAI
Vendor-released patch: upgrade to Traefik v3.7.12, which fixes the sibling-router middleware handling (see GHSA-cjr6-pf59-jq29). If immediate patching is not possible, the most direct compensating control is to remove the nginx.ingress.kubernetes.io/from-to-www-redirect annotation from any Ingress that also carries an authentication annotation, which eliminates the vulnerable sibling router at the cost of losing automatic www redirect behavior. Alternatively, avoid the ingress-nginx provider for protected routes and express authentication and redirects via native Traefik IngressRoute/Middleware resources, or enforce authentication and source-IP allowlisting at a layer that cannot be bypassed by router selection (for example a service-mesh policy or backend-side auth). Validate any change by sending requests with non-numeric or empty ports in the Host authority (e.g. 'Host: www.example.com:x') and confirming they are rejected rather than proxied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Traefik is a Go-based HTTP reverse proxy and load balancer commonly deployed as a Kubernetes ingress controller (CPE cpe:2.3:a:traefik:traefik). The flaw lives in the newer ingress-nginx provider, which translates nginx-style Ingress annotations into Traefik routers and middleware chains. When an Ingress combines an auth annotation with from-to-www-redirect, the provider emits an extra router matching on host alone whose only middleware is RedirectRegex. RedirectRegex is not a terminal handler: if the incoming request does not match its redirect pattern, the request falls through to the router's backend rather than being rejected. The redirect pattern only accepts a numeric port, while Traefik's host matcher canonicalizes the authority through net.SplitHostPort, so an authority like 'www.example.com:x' (non-numeric or empty port) satisfies the host match but fails the redirect regex - routing straight to the protected service. This is a CWE-639 authorization-bypass-through-user-controlled-key pattern: the effective authorization control (the annotation-derived middleware chain, including BasicAuth and source-IP allowlists) is silently omitted on the sibling router.
Know when Traefik gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, single crafted Host header (AC:L) bypasses all middleware to reach the protected backend, yielding high C/I/A; the affected annotation combo is a config precondition, not an access requirement.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.
Articles & Coverage 1
Technical POC Analysis
CWE-639 is supplied for this report, though the advisory text lists no CWE.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Traefik versions 3.7.0-3.7.11 contain a critical authentication bypass vulnerability (CVSS 9.3) allowing unauthenticated attackers to access protected Kubernetes backend services when the ingress-nginx compatibility provider is used with specific annotation combinations. Organizations running affected versions face immediate risk of unauthorized access to sensitive backend systems, with no public exploit code required-the vulnerability is straightforward to exploit.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Remove the nginx.ingress.kubernetes.io/from-to-www-redirect annotation from all affected Ingress resources; (2) Deploy Kubernetes NetworkPolicy restricting ingress controller egress to authorized backend pods only; (3) Implement application-layer authentication (API keys, mTLS, OAuth2 proxy) independent of ingress annotations; (4) Enable audit logging and implement intrusion detection monitoring on backend services; (5) If ingress-nginx provider is not required, disable it and use Traefik's native ingress support instead.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route pr
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthen
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a r
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unau
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endp
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is re
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated net
Traefik's header-security defenses (aliasHeadersStrategy, underscoreHeadersStrategy, forwardedHeaders) inspect req.Heade
Path normalization bypass in Traefik allows unauthenticated remote attackers to circumvent the middleware chain on path-
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Exploit-DB