Live › vulnerability › CVE-2026-114636
Go to dashboardTraefik's Kubernetes Ingress NGINX provider builds the HTTP router for ssl-passthrough Ingresses without applying their access-control annotations. An unauthenticated attacker who reaches the HTTP entry point with the Ingress host can reach backends protected by auth-type, auth-url, or whitelist-source-range, and nothing is logged.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run: traefik version (unknown if the sources give a exact command for this)
List Ingresses with ssl-passthrough: kubectl get ingress -A -o yaml | grep -i ssl-passthrough
Check whether those Ingresses also use auth-type, auth-url or whitelist-source-range annotations.
v3.7.13 to v3.7.14 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.
This page as .md · .json · in your agent: get_signal("CVE-2026-114636")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.