Database/Container, Kubernetes & orchestration

Traefik: ssl-passthrough Ingress on a non-TLS entry point drops all access-control annotations

CVSS 7.0CVE-2026-114636Container, Kubernetes & orchestrationcurated

Impact

For an Ingress using ssl-passthrough, the HTTP router Traefik generates on a non-TLS entry point never applies the Ingress access-control annotations. Backends that operators believe are gated by auth-type, auth-url or whitelist-source-range are reachable with no credentials and no source-IP restriction, and nothing is logged, so the bypass leaves no trace in the ingress audit trail. In a shared cluster this exposes whatever sits behind those Ingresses - internal dashboards, inference endpoints, control APIs - to anyone who can reach the HTTP entry point and send the right Host header.

Who can reach it

Unauthenticated. Anyone who can reach Traefik's plain HTTP entry point and knows or guesses the Ingress hostname.

What to do

Upgrade Traefik to v3.7.14 and roll the ingress controller pods; this is a control-plane component restart, no node drain or reboot. Before patching, either remove the non-TLS entry point from affected ssl-passthrough Ingresses or enforce the access control in the backend itself, since the annotations provide no protection on that path.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-114636 https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q https://www.vulncheck.com/advisories/traefik-3.7.13-authentication-bypass-via-ssl-passthrough-ingress-http-router

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.