GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-qvj7-gq9c-hp7q · Package
FIX → v3.7.14
In Traefik v3.7.13, a Kubernetes Ingress with the ssl-passthrough annotation gets an extra HTTP router that ignores the access-control annotations on that Ingress. An unauthenticated client who reaches the HTTP entry point with the Ingress host can reach a backend the operator meant to protect, with no authentication or source allow-listing applied.
first public Oct 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Traefik v3.7.13 as a Kubernetes Ingress controller with the Kubernetes Ingress NGINX provider, where an Ingress uses ssl-passthrough together with auth annotations. Traefik v2 and versions before v3.7.13 are not affected according to the advisory.
Not affected if default-config, no-ssl-passthrough, traefik-before-3.7.13
Who cares ingress-nginx, kubernetes, self-hosted, traefik
traefik version or the image tag; affected is v3.7.13 only.nginx.ingress.kubernetes.io/ssl-passthrough: "true" and check whether they also set auth-type, auth-url or whitelist-source-range.There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. Since v3.7.13, an Ingress carrying the nginx.ingress.kubernetes.io/ssl-passthrough: "true" annotation gets, besides its TCP passthrough router, an HTTP router on the non-TLS entry points that proxies to the backend. That router was built outside the regular per-rule processing, so the access-control annotations set on the same Ingress, such as auth-type with auth-secret, auth-url and whitelist-source-range, were parsed but never turned into middlewares on it. An unauthenticated client reaching the HTTP entry point with the Ingress host could therefore reach a backend the operator had annotated as protected, with no authentication and no source allow-listing applied, and nothing logged. The HTTP side of an ssl-passthrough Ingress is now built like any other Ingress, with its annotation directives applied; the routers it generates are renamed as a result, see the v3.7.14 migration guide. Traefik v2 and Traefik v3 versions before v3.7.13 are not affected.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v3.7.14
v3.7.14, then follow the v3.7.14 migration guide, since the routers generated for ssl-passthrough Ingresses are renamed.