CVE-2026-88877 in Traefik
Summary
by MITRE • 09/10/2026
Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
Traefik versions 3.7.0 through 3.7.11 contain a critical security vulnerability within the Kubernetes ingress-nginx provider that results in the bypass of authentication and access control mechanisms for specific Ingress configurations. This flaw arises from an incorrect handling of Ingress resources that include both authentication annotations, such as BasicAuth or OAuth2, and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The vulnerability stems from a logic error where the provider generates an additional sibling router intended to handle domain redirection between www and non-www subdomains. This sibling router is configured with a host matcher that operates independently of the parent Ingress's security middleware chain, creating a separate entry point into the backend service that lacks the protective layers defined in the original resource specification.
The technical root cause involves how Traefik processes routing rules when both redirection and authentication are present. The provider creates a sibling router that matches requests based solely on the host header using a RedirectRegex middleware. Because this redirect middleware is not terminal, any request whose URL path does not match the specific regex pattern for www-to-non-www or vice versa redirects fails to trigger an immediate response. Instead, the request continues down the routing chain and is forwarded to the backend service associated with that router. Crucially, while Traefik canonicalizes the authority by splitting the host and port using net.SplitHostPort, it allows requests containing non-numeric or empty ports in the Host header, such as www.example.com:x, to match this sibling router's criteria. Since the sibling router does not inherit the authentication middlewares from the parent Ingress resource, these requests bypass all security checks entirely.
The operational impact of this vulnerability is severe, effectively nullifying the security posture intended by the system administrator for affected services. An attacker can exploit this flaw to access protected backend applications without providing valid credentials or meeting source-IP allowlisting requirements. This means that sensitive APIs, administrative interfaces, and internal microservices configured with strict authentication policies become publicly accessible if they are exposed via an Ingress resource utilizing both redirection annotations and security middlewares. The vulnerability affects not only BasicAuth but also other annotation-derived middleware such as OAuth2, JWT validation, and IP whitelisting rules, leading to a complete compromise of access control integrity for the affected services.
This issue is classified under CWE-284 Improper Access Control and aligns with MITRE ATT&CK technique T1078 Valid Accounts or potentially T1190 Exploit Public-Facing Application depending on whether credentials are stolen or bypassed entirely through this logic flaw. The vulnerability exists because the routing engine fails to enforce a consistent security policy across all entry points that lead to the same backend service, allowing an attacker to sidestep authentication by manipulating HTTP headers in conjunction with specific annotation combinations. This represents a significant deviation from the principle of least privilege and secure default configurations expected in reverse proxy environments handling sensitive traffic.
To mitigate this vulnerability, organizations running Traefik versions 3.7.0 through 3.7.11 must upgrade to version 3.7.12 or later immediately. The fix addresses the logic error by ensuring that sibling routers generated for redirection purposes correctly inherit and apply all middleware defined in the parent Ingress resource, thereby maintaining security controls regardless of how the request is routed internally. Until an upgrade can be performed, administrators should consider removing the nginx.ingress.kubernetes.io/from-to-www-redirect annotation from any Ingress resources that also contain authentication or access control annotations as a temporary workaround. Additionally, monitoring logs for unusual traffic patterns targeting backend services with non-standard port specifications in Host headers may help identify potential exploitation attempts during the transition period.