Description

Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-10T14:17:16.023Z",
  "pubdate": "2026-09-10T14:17:16.023Z",
  "executiveSummary": "A critical security vulnerability exists in Traefik versions v3.7.0 through v3.7.11 regarding the Kubernetes ingress-nginx provider. The flaw involves a logic error when handling specific concurrent ingress annotations, specifically authentication annotations combined with 'nginx.ingress.kubernetes.io/from-to-www-redirect'.\nThis vulnerability allows an attacker to bypass critical security controls, including BasicAuth and IP-based allowlisting, by crafting requests that trigger a specific route selection failure. By providing a malformed 'Host' header, the system inadvertently routes traffic to a backend service while stripping all configured middleware.\nThe impact is severe, as it grants unauthorized access to protected backend services that assume security controls are being enforced by the proxy. An attacker does not require prior authentication to exploit this, as the bypass occurs before the authentication middleware is invoked. This vulnerability poses a significant risk to the integrity and confidentiality of internal services exposed via the affected Traefik configurations.\nThe issue is resolved in Traefik v3.7.12. Users are urged to upgrade immediately to remediate this bypass vector.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper generation of sibling routers within the Traefik Kubernetes ingress-nginx provider. When an Ingress resource contains both authentication-related annotations and the 'nginx.ingress.kubernetes.io/from-to-www-redirect' annotation, the provider creates a secondary, 'sibling' router. This router is designed to match solely on the host header and includes a 'RedirectRegex' middleware to handle www-to-non-www (or vice versa) traffic redirection.\nThe vulnerability stems from the non-terminal nature of the 'RedirectRegex' middleware and the canonicalization logic in Traefik's host matcher. The host matcher utilizes 'net.SplitHostPort' to parse the 'Host' header. If an attacker submits a request with a malformed authority segment—specifically using a non-numeric or empty port (e.g., 'Host: www.example.com:x')—the canonicalization process interacts unpredictably with the sibling router's matching logic.\nThe attack flow proceeds as follows: 1) An attacker identifies an ingress protected by annotation-based middleware, such as BasicAuth or IP allowlisting. 2) The attacker crafts an HTTP request where the 'Host' header is formatted with an invalid port, such as 'Host: example.com:x'. 3) Due to the aforementioned matching logic, the Traefik proxy selects the sibling router instead of the primary, protected parent router. 4) Because the sibling router only contains the 'RedirectRegex' middleware and does not match the attacker's malformed authority string, the redirect is bypassed.\nCrucially, because 'RedirectRegex' is not a terminal handler and the conditions for the redirect fail, the proxy proceeds to forward the request directly to the backend service. Since the sibling router lacks the authentication and security-related middlewares defined in the parent ingress, these protections are discarded entirely. The request reaches the backend service without any authorization or source-IP validation applied. This results in an effective authentication bypass, allowing unauthenticated attackers to interact with protected endpoints directly. The vulnerability affects Traefik versions v3.7.0 through v3.7.11, as the internal logic for creating these sibling routers was introduced in v3.7.0 and rectified in v3.7.12."
}