---
id: "GHSA-qvj7-gq9c-hp7q"
page: "https://infrastack.ai/live/GHSA-qvj7-gq9c-hp7q"
kind: "vulnerability"
aliases: ["GHSA-qvj7-gq9c-hp7q"]
title: "Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.14"], "affected": ">= v3.7.13, <= v3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-306", "ingress-nginx", "kubernetes", "package", "self-hosted", "traefik"]
not_affected_if: ["default-config", "no-ssl-passthrough", "traefik-before-3.7.13"]
published_at: "2026-10-07T08:47:51+00:00"
first_seen_at: "2026-11-09T22:53:33+00:00"
updated_at: "2026-11-09T22:59:34+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q", "first_seen_at": "2026-11-09T22:53:33+00:00"}]
exploit_sources: []
---

# Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth

Link for people: https://infrastack.ai/live/GHSA-qvj7-gq9c-hp7q (this .md is for agents)

In Traefik v3.7.13, a Kubernetes Ingress with the ssl-passthrough annotation gets an extra HTTP router that ignores the access-control annotations on that Ingress. An unauthenticated client who reaches the HTTP entry point with the Ingress host can reach a backend the operator meant to protect, with no authentication or source allow-listing applied.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.7.13, <= v3.7.13 fixed v3.7.14

## How to check

- Check the Traefik version in use with `traefik version` or the image tag; affected is `v3.7.13` only.
- Find Ingresses with the annotation `nginx.ingress.kubernetes.io/ssl-passthrough: "true"` and check whether they also set `auth-type`, `auth-url` or `whitelist-source-range`.
- Test the Ingress host over plain HTTP without credentials to see whether the backend answers.

## Fix

- Traefik: move to `v3.7.14`, then follow the v3.7.14 migration guide, since the routers generated for ssl-passthrough Ingresses are renamed.

## Timeline

- 2026-11-09T22:53:33+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q

## From the sources

## Summary

There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. Since v3.7.13, an Ingress carrying the `nginx.ingress.kubernetes.io/ssl-passthrough: "true"` annotation gets, besides its TCP passthrough router, an HTTP router on the non-TLS entry points that proxies to the backend. That router was built outside the regular per-rule processing, so the access-control annotations set on the same Ingress, such as `auth-type` with `auth-secret`, `auth-url` and `whitelist-source-range`, were parsed but never turned into middlewares on it. An unauthenticated client reaching the HTTP entry point with the Ingress host could therefore reach a backend the operator had annotated as protected, with no authentication and no source allow-listing applied, and nothing logged. The HTTP side of an ssl-passthrough Ingress is now built like any other Ingress, with its annotation directives applied; the routers it generates are renamed as a result, see the v3.7.14 migration guide. Traefik v2 and Traefik v3 versions before v3.7.13 are not affected.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.14

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_