{"id":"CVE-2026-114636","kind":"vulnerability","aliases":["CVE-2026-114636"],"related":[],"title":"Traefik: Kubernetes Ingress NGINX provider skips access controls on HTTP","description":"Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.","summary":"Traefik's Kubernetes Ingress NGINX provider builds the HTTP router for ssl-passthrough Ingresses without applying their access-control annotations. An unauthenticated attacker who reaches the HTTP entry point with the Ingress host can reach backends protected by auth-type, auth-url, or whitelist-source-range, and nothing is logged.","severity":"high","cvss":8.7,"epss":0.00256,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ingress-nginx-provider","kubernetes","runtime","traefik"],"not_affected_if":["no-access-control-annotations","no-ssl-passthrough-ingress","not-on-3.7.13"],"how_to_check":"Run: traefik version (unknown if the sources give a exact command for this)\nList Ingresses with ssl-passthrough: kubectl get ingress -A -o yaml | grep -i ssl-passthrough\nCheck whether those Ingresses also use auth-type, auth-url or whitelist-source-range annotations.","fix":"Upgrade Traefik from v3.7.13 to v3.7.14 or later.\nUntil then, unknown whether a config workaround exists.","status":"open","published_at":"2026-10-22T02:16:56+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:35:31+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:35:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Traefik from v3.7.13 to v3.7.14 or later.\nUntil then, unknown whether a config workaround exists.","reach":"internet","title":"Traefik: Kubernetes Ingress NGINX provider skips access controls on HTTP","impact":"high","summary":"Traefik's Kubernetes Ingress NGINX provider builds the HTTP router for ssl-passthrough Ingresses without applying their access-control annotations. An unauthenticated attacker who reaches the HTTP entry point with the Ingress host can reach backends protected by auth-type, auth-url, or whitelist-source-range, and nothing is logged.","category":"runtime","who_cares":["traefik","kubernetes","ingress-nginx-provider"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated access to backends meant to be protected, with no log entry","analyst_note":"Confirm the affected version range against the Traefik release notes and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114636, and find any documented workaround.","how_to_check":"Run: traefik version (unknown if the sources give a exact command for this)\nList Ingresses with ssl-passthrough: kubectl get ingress -A -o yaml | grep -i ssl-passthrough\nCheck whether those Ingresses also use auth-type, auth-url or whitelist-source-range annotations.","needs_analyst":true,"not_affected_if":["not-on-3.7.13","no-ssl-passthrough-ingress","no-access-control-annotations"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000592,"input_tokens":2983,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114636':13A,16A '-2026':12A,15A 'access':7A,43B,86C,117C,132C 'access-control':42B,85C,116C 'annot':45B,119C,147C 'appli':40B,112C 'attack':48B,121C 'auth':65B,68B,137C,140C 'auth-typ':64B,136C 'auth-url':67B,139C 'backend':61B,133C 'build':30B 'bypass':88C 'contain':83C 'control':8A,44B,87C,118C 'cve':11A,14A 'entri':53B,109C,125C 'generat':99C 'host':58B,130C 'http':10A,32B,52B,97C,124C 'ingress':3A,18B,27B,38B,57B,92C,104C,114C,129C 'ingress-nginx-provid':17B 'kubernet':2A,21B,26B,91C 'log':78B,150C 'never':111C 'nginx':4A,19B,28B,93C 'non':107C 'non-tl':106C 'noth':76B,149C 'passthrough':37B,103C 'point':54B,110C,126C 'protect':62B,134C 'provid':5A,20B,29B,94C 'rang':74B,146C 'reach':50B,60B,122C 'router':33B,98C 'runtim':22B 'skip':6A 'sourc':73B,145C 'ssl':36B,102C 'ssl-passthrough':35B,101C 'tls':108C 'traefik':1A,23B,24B,79C 'type':66B,138C 'unauthent':47B,120C 'url':69B,141C 'v3.7.13':80C 'v3.7.14':82C 'whitelist':72B,144C 'whitelist-source-rang':71B,143C 'without':39B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114636","severity":null,"published_at":"2026-10-22T02:16:56+00:00","modified_at":"2026-10-22T15:39:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114636","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114636","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}