---
id: "CVE-2026-114636"
kind: "vulnerability"
aliases: ["CVE-2026-114636"]
title: "Traefik: Kubernetes Ingress NGINX provider skips access controls on HTTP"
severity: "high"
cvss: 8.7
epss: 0.00256
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ingress-nginx-provider", "kubernetes", "runtime", "traefik"]
not_affected_if: ["no-access-control-annotations", "no-ssl-passthrough-ingress", "not-on-3.7.13"]
published_at: "2026-10-22T02:16:56+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114636", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114636", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Traefik: Kubernetes Ingress NGINX provider skips access controls on HTTP

Traefik's Kubernetes Ingress NGINX provider builds the HTTP router for ssl-passthrough Ingresses without applying their access-control annotations. An unauthenticated attacker who reaches the HTTP entry point with the Ingress host can reach backends protected by auth-type, auth-url, or whitelist-source-range, and nothing is logged.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run: traefik version (unknown if the sources give a exact command for this)
List Ingresses with ssl-passthrough: kubectl get ingress -A -o yaml | grep -i ssl-passthrough
Check whether those Ingresses also use auth-type, auth-url or whitelist-source-range annotations.

## Fix

Upgrade Traefik from v3.7.13 to v3.7.14 or later.
Until then, unknown whether a config workaround exists.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114636
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114636

## From the sources

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_