CVE-2026-114636 traefik CVE debrief

Who should care

Administrators and security teams responsible for Traefik deployments, particularly those using Kubernetes Ingress NGINX provider, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-114636 is a high-severity vulnerability in Traefik that allows unauthenticated attackers to bypass access controls and access sensitive resources. Administrators and security teams responsible for Traefik deployments should assess their exposure and take necessary actions to mitigate the vulnerability.

• Unauthenticated access to sensitive resources
• Potential data breaches or unauthorized modifications
• Increased risk of lateral movement within the network
• Need for urgent patching or mitigation

Technical summary

The vulnerability is caused by an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. This allows unauthenticated attackers to access backends protected by auth-type, auth-url, or whitelist-source-range annotations. The vulnerability affects Traefik version 3.7.13 and earlier, and it allows unauthenticated attackers to bypass access controls and access backends protected by authentication annotations. Administrators and security teams responsible for Traefik deployments, particularly those using Kubernetes Ingress NGINX provider, should assess their exposure.

Defensive priority

High

Recommended defensive actions

• Upgrade to Traefik version 3.7.14 or later
• Review and update access control annotations for Ingress resources
• Monitor for suspicious activity and implement additional security measures
• Confirm whether affected Traefik deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. This allows unauthenticated attackers to access backends protected by auth-type, auth-url, or whitelist-source-range annotations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.