Traefik: crafted Host port bypasses BasicAuth and IP allowlists on ingress-nginx annotated Ingresses

Impact

For an Ingress that carries both an authentication annotation and nginx.ingress.kubernetes.io/from-to-www-redirect, Traefik's ingress-nginx provider builds an extra router matching on host alone, carrying only RedirectRegex but still pointing at the protected backend. RedirectRegex is not terminal and its pattern only accepts a numeric port, so a request with a non-numeric or empty port in the authority (for example Host: www.example.com:x) selects the sibling router, skips the redirect, and is proxied straight to the backend with none of the annotation-derived middlewares applied. That drops BasicAuth and also source-IP allowlisting, which is how many operators fence off internal endpoints - an inference endpoint, a model registry, or a dashboard that was only ever meant to be reachable from the management network becomes reachable by anyone who can send an HTTP request to the ingress. No credentials and no cluster access are needed.

Who can reach it

Anyone who can reach the Traefik ingress, unauthenticated, over the network. Only affects Ingress objects that carry both an auth annotation and the from-to-www-redirect annotation while Traefik runs its ingress-nginx provider.

What to do

Upgrade Traefik to v3.7.12; v3.7.0 through v3.7.11 are affected and v2 and pre-3.7.0 v3 releases are not. Rolling the Traefik deployment is an ingress restart, no node drain. As an interim step, remove the from-to-www-redirect annotation from Ingresses that also carry auth annotations, or disable the ingress-nginx provider, and review access logs for requests whose Host header carries a non-numeric or empty port.

References

Related entries

• Kata Containers: runtime-rs standalone virtio-fs path is vulnerable to a guest-to-host escapeCVE-2026-47243 · Kata ContainersCritical
• Cilium: With L7 enabled, the embedded Envoy exposes a world-accessible admin.sock on the clusterCVE-2026-49445 · CiliumCritical
• Rancher: Anyone who can create role template bindings escalates privileges cluster-wideCVE-2022-31247 · RancherCritical
• Argo CD: Improper authorization lets a user modify resources outside their permitted projectsCVE-2023-23947 · Argo CDCritical
• MCE ClusterCurator: a namespace-scoped tenant admin can mint a cluster-admin ServiceAccount tokenCVE-2026-10059 · Red Hat Multicluster Engine for Kubernetes (ClusterCurator controller)Critical
• Argo CD: Stored XSS via a `javascript:` link executes in an admin's browserCVE-2022-31035 · Argo CDCritical