Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

Published September 10, 2026 CVE-2026-88877

Traefik can send requests to protected Kubernetes services without authentication. The issue affects one specific redirect setup in Traefik's Kubernetes provider.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Not confirmedLast checked yesterday
Affected versions
3.7.0 through 3.7.13
Weakness
CWE-639Authorization Bypass Through User-Controlled Key
Exploit likelihood
0.44% in 30 daysEPSS, higher than 37% of known flaws
Affects
Traefik
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: total
EU ID
EUVD-2026-75427ENISA vulnerability database

How it works

  • An affected Kubernetes Ingress combines authentication with Traefik's automatic www redirect.
  • A specially formed request can select a redirect route that keeps the protected backend but drops the Ingress's access controls.
  • The request then reaches that backend without authentication or other annotation-based protections.

What to do

Check the Traefik version used by your Kubernetes deployment and review Ingress definitions for both required annotations. Compare the result with the affected versions and conditions in the Traefik advisory.

Confirm the applicable fixed release with Traefik before upgrading, then verify that the running deployment uses it.

Technical details

Traefik's Kubernetes ingress-nginx provider can create a second redirect route without authentication or other Ingress-derived protections. The CVE authority record lists versions 3.7.0 through 3.7.13 as affected, while the vendor advisory says the issue is fixed in 3.7.12.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source