SB2026082157 - Multiple vulnerabilities in Traefik
Published: August 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the Kubernetes Ingress provider service middleware annotation handling when processing the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A remote user can attach an operator-owned middleware from another provider to its own Service to disclose sensitive information.
Exploitation requires a namespace-limited tenant excluded from the allowlist and a security-sensitive middleware whose qualified name is known to the tenant.
2) Incorrect Implementation of Authentication Algorithm (CVE-ID: N/A)
CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper authentication in the digestAuth middleware when handling digest authentication requests for usernames absent from the configured user list. A remote attacker can send a specially crafted authorization header to bypass authentication.
If headerField is configured, the attacker\'s chosen username is forwarded to the backend in the configured request header. The forged username may also be recorded in access logs as the authenticated user.
3) Improper Authentication (CVE-ID: N/A)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client-certificate authentication.
The vulnerability exists due to improper authentication in the Kubernetes Ingress NGINX provider when processing multiple HTTPS Ingress objects for the same host with different generated TLS option names. A remote attacker can access a route without presenting a client certificate to bypass client-certificate authentication.
The issue occurs when the same host is split across multiple Ingress objects that use the same client CA secret and client-authentication mode, causing Traefik to treat TLS option selection as ambiguous and fall back to the default TLS configuration.
4) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client-certificate authentication and access a protected backend.
The vulnerability exists due to improper access control in TLS options conflict resolution for multi-host routers when handling TLS handshakes for overlapping host rules with different TLS options. A remote attacker can connect to a protected hostname without a client certificate to bypass client-certificate authentication and access a protected backend.
The issue is limited to configurations where a multi-host router overlaps another router with a different TLS option for only one of its hostnames.
Remediation
Install update from vendor's website.