{"id":"GHSA-qvj7-gq9c-hp7q","kind":"vulnerability","aliases":["GHSA-qvj7-gq9c-hp7q"],"related":[],"title":"Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. Since v3.7.13, an Ingress carrying the `nginx.ingress.kubernetes.io/ssl-passthrough: \"true\"` annotation gets, besides its TCP passthrough router, an HTTP router on the non-TLS entry points that proxies to the backend. That router was built outside the regular per-rule processing, so the access-control annotations set on the same Ingress, such as `auth-type` with `auth-secret`, `auth-url` and `whitelist-source-range`, were parsed but never turned into middlewares on it. An unauthenticated client reaching the HTTP entry point with the Ingress host could therefore reach a backend the operator had annotated as protected, with no authentication and no source allow-listing applied, and nothing logged. The HTTP side of an ssl-passthrough Ingress is now built like any other Ingress, with its annotation directives applied; the routers it generates are renamed as a result, see the v3.7.14 migration guide. Traefik v2 and Traefik v3 versions before v3.7.13 are not affected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"In Traefik v3.7.13, a Kubernetes Ingress with the ssl-passthrough annotation gets an extra HTTP router that ignores the access-control annotations on that Ingress. An unauthenticated client who reaches the HTTP entry point with the Ingress host can reach a backend the operator meant to protect, with no authentication or source allow-listing applied.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.14"],"affected":">= v3.7.13, <= v3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-306","ingress-nginx","kubernetes","package","self-hosted","traefik"],"not_affected_if":["default-config","no-ssl-passthrough","traefik-before-3.7.13"],"how_to_check":"- Check the Traefik version in use with `traefik version` or the image tag; affected is `v3.7.13` only.\n- Find Ingresses with the annotation `nginx.ingress.kubernetes.io/ssl-passthrough: \"true\"` and check whether they also set `auth-type`, `auth-url` or `whitelist-source-range`.\n- Test the Ingress host over plain HTTP without credentials to see whether the backend answers.","fix":"- Traefik: move to `v3.7.14`, then follow the v3.7.14 migration guide, since the routers generated for ssl-passthrough Ingresses are renamed.","status":"open","published_at":"2026-10-07T08:47:51+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","triaged_at":"2026-11-09T22:59:34+00:00","updated_at":"2026-11-09T22:59:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:59:34Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik: move to `v3.7.14`, then follow the v3.7.14 migration guide, since the routers generated for ssl-passthrough Ingresses are renamed.","reach":"internet","title":"Traefik: ssl-passthrough HTTP router skips auth on Kubernetes Ingress backends","impact":"medium","summary":"In Traefik v3.7.13, a Kubernetes Ingress with the ssl-passthrough annotation gets an extra HTTP router that ignores the access-control annotations on that Ingress. An unauthenticated client who reaches the HTTP entry point with the Ingress host can reach a backend the operator meant to protect, with no authentication or source allow-listing applied.","audience":"developers","category":"package","nicknames":[],"who_cares":["traefik","kubernetes","ingress-nginx","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated access to backends meant to be protected","analyst_note":"","how_to_check":"- Check the Traefik version in use with `traefik version` or the image tag; affected is `v3.7.13` only.\n- Find Ingresses with the annotation `nginx.ingress.kubernetes.io/ssl-passthrough: \"true\"` and check whether they also set `auth-type`, `auth-url` or `whitelist-source-range`.\n- Test the Ingress host over plain HTTP without credentials to see whether the backend answers.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-ssl-passthrough","traefik-before-3.7.13"],"who_is_affected":"Teams running Traefik v3.7.13 as a Kubernetes Ingress controller with the Kubernetes Ingress NGINX provider, where an Ingress uses ssl-passthrough together with auth annotations. Traefik v2 and versions before v3.7.13 are not affected according to the advisory.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000865,"input_tokens":5020,"output_tokens":726,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-306':33B '/ssl-passthrough:':123C '/traefik/traefik/issues).':300C '/traefik/traefik/releases/tag/v3.7.14':280C '/traefik/traefik/v3':31A 'access':64B,161C 'access-control':63B,160C 'advisori':293C 'affect':276C 'allow':98B,225C 'allow-list':97B,224C 'annot':54B,66B,125C,163C,215C,249C 'appli':100B,227C,251C 'auth':14A,18A,172C,176C,179C 'auth-protect':13A 'auth-secret':175C 'auth-typ':171C 'auth-url':178C 'authent':94B,220C 'backend':16A,86B,146C,211C 'besid':127C 'built':150C,242C 'carri':119C 'client':72B,197C 'comment':290C 'control':65B,162C 'could':207C 'cwe':32B 'direct':250C 'entri':77B,140C,201C 'extra':57B 'generat':255C 'get':55B,126C 'ghsa':20A,25A 'ghsa-qvj7-gq9c-hp7q':19A,24A 'github.com':30A,279C,299C 'github.com/traefik/traefik/issues).':298C 'github.com/traefik/traefik/releases/tag/v3.7.14':278C 'github.com/traefik/traefik/v3':29A 'gq9c':22A,27A 'guid':265C 'high':105C 'host':41B,82B,206C 'hp7q':23A,28A 'http':9A,58B,76B,133C,200C,232C 'ignor':61B 'inform':283C 'ingress':2A,35B,48B,69B,81B,112C,118C,168C,205C,239C,246C 'ingress-nginx':34B 'issu':297C 'kubernet':1A,37B,47B,111C 'like':243C 'list':99B,226C 'log':230C 'meant':89B 'middlewar':192C 'migrat':264C 'never':189C 'nginx':3A,36B,113C 'nginx.ingress.kubernetes.io':122C 'nginx.ingress.kubernetes.io/ssl-passthrough:':121C 'non':138C 'non-tl':137C 'noth':229C 'open':295C 'oper':88B,213C 'outsid':151C 'packag':38B 'pars':187C 'passthrough':7A,53B,130C,238C 'patch':277C 'per':155C 'per-rul':154C 'pleas':294C 'point':78B,141C,202C 'process':157C 'protect':15A,91B,217C 'provid':4A,114C 'proxi':143C 'question':288C 'qvj7':21A,26A 'rang':185C 'reach':74B,84B,198C,209C 'regular':153C 'renam':257C 'result':260C 'router':10A,59B,131C,134C,148C,253C 'rule':156C 'secret':177C 'see':261C 'self':40B 'self-host':39B 'serv':11A 'set':164C 'sever':106C 'sibl':8A 'side':233C 'sinc':115C 'sourc':96B,184C,223C 'ssl':6A,52B,237C 'ssl-passthrough':5A,51B,236C 'summari':101C 'tcp':129C 'therefor':208C 'tls':139C 'traefik':42B,44B,109C,266C,269C 'true':124C 'turn':190C 'type':173C 'unauthent':71B,196C 'url':180C 'v2':267C 'v3':270C 'v3.7.13':45B,116C,273C 'v3.7.14':263C 'version':271C 'vulner':107C 'whitelist':183C 'whitelist-source-rang':182C 'without':17A","nicknames":[],"mitigations":[],"who_affected":"Teams running Traefik v3.7.13 as a Kubernetes Ingress controller with the Kubernetes Ingress NGINX provider, where an Ingress uses ssl-passthrough together with auth annotations. Traefik v2 and versions before v3.7.13 are not affected according to the advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v3"],"labels":["cwe306","go","high","ingressnginx","kubernetes","package","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v3':31A 'auth':14A,18A 'auth-protect':13A 'backend':16A 'ghsa':20A,25A 'ghsa-qvj7-gq9c-hp7q':19A,24A 'github.com':30A 'github.com/traefik/traefik/v3':29A 'gq9c':22A,27A 'hp7q':23A,28A 'http':9A 'ingress':2A 'kubernet':1A 'nginx':3A 'passthrough':7A 'protect':15A 'provid':4A 'qvj7':21A,26A 'router':10A 'serv':11A 'sibl':8A 'ssl':6A 'ssl-passthrough':5A 'without':17A","search_b":"'-306':33B 'access':64B 'access-control':63B 'allow':98B 'allow-list':97B 'annot':54B,66B 'appli':100B 'authent':94B 'backend':86B 'client':72B 'control':65B 'cwe':32B 'entri':77B 'extra':57B 'get':55B 'host':41B,82B 'http':58B,76B 'ignor':61B 'ingress':35B,48B,69B,81B 'ingress-nginx':34B 'kubernet':37B,47B 'list':99B 'meant':89B 'nginx':36B 'oper':88B 'packag':38B 'passthrough':53B 'point':78B 'protect':91B 'reach':74B,84B 'router':59B 'self':40B 'self-host':39B 'sourc':96B 'ssl':52B 'ssl-passthrough':51B 'traefik':42B,44B 'unauthent':71B 'v3.7.13':45B","search_c":"'/ssl-passthrough:':123C '/traefik/traefik/issues).':300C '/traefik/traefik/releases/tag/v3.7.14':280C 'access':161C 'access-control':160C 'advisori':293C 'affect':276C 'allow':225C 'allow-list':224C 'annot':125C,163C,215C,249C 'appli':227C,251C 'auth':172C,176C,179C 'auth-secret':175C 'auth-typ':171C 'auth-url':178C 'authent':220C 'backend':146C,211C 'besid':127C 'built':150C,242C 'carri':119C 'client':197C 'comment':290C 'control':162C 'could':207C 'direct':250C 'entri':140C,201C 'generat':255C 'get':126C 'github.com':279C,299C 'github.com/traefik/traefik/issues).':298C 'github.com/traefik/traefik/releases/tag/v3.7.14':278C 'guid':265C 'high':105C 'host':206C 'http':133C,200C,232C 'inform':283C 'ingress':112C,118C,168C,205C,239C,246C 'issu':297C 'kubernet':111C 'like':243C 'list':226C 'log':230C 'middlewar':192C 'migrat':264C 'never':189C 'nginx':113C 'nginx.ingress.kubernetes.io':122C 'nginx.ingress.kubernetes.io/ssl-passthrough:':121C 'non':138C 'non-tl':137C 'noth':229C 'open':295C 'oper':213C 'outsid':151C 'pars':187C 'passthrough':130C,238C 'patch':277C 'per':155C 'per-rul':154C 'pleas':294C 'point':141C,202C 'process':157C 'protect':217C 'provid':114C 'proxi':143C 'question':288C 'rang':185C 'reach':198C,209C 'regular':153C 'renam':257C 'result':260C 'router':131C,134C,148C,253C 'rule':156C 'secret':177C 'see':261C 'set':164C 'sever':106C 'side':233C 'sinc':115C 'sourc':184C,223C 'ssl':237C 'ssl-passthrough':236C 'summari':101C 'tcp':129C 'therefor':208C 'tls':139C 'traefik':109C,266C,269C 'true':124C 'turn':190C 'type':173C 'unauthent':196C 'url':180C 'v2':267C 'v3':270C 'v3.7.13':116C,273C 'v3.7.14':263C 'version':271C 'vulner':107C 'whitelist':183C 'whitelist-source-rang':182C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-qvj7-gq9c-hp7q","url":"https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q","severity":"high","published_at":"2026-10-07T08:47:51+00:00","modified_at":"2026-10-07T08:47:51+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","fetched_at":"2026-11-09T22:53:33+00:00","note":null}],"documents":[{"id":46263,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:51+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}