SB20260827144 - Multiple vulnerabilities in Traefik
Published: August 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication and other annotation-derived access restrictions.
The vulnerability exists due to improper access control in the Kubernetes ingress-nginx provider sibling router handling when processing requests for an Ingress that combines an authentication annotation with from-to-www-redirect. A remote attacker can send a specially crafted request with a non-numeric or empty port in the Host header to bypass authentication and other annotation-derived access restrictions.
Requests may be forwarded to the protected backend through a sibling router that matches on the host alone and omits annotation-derived middlewares. Paths not present in the Ingress may also be reachable, and the request method is unconstrained.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the HTTP/3 request handling path when processing slow-body uploads. A remote attacker can send a slowly trickled request body to cause a denial of service.
Only deployments with HTTP/3 enabled are vulnerable.
3) Authentication Bypass by Spoofing (CVE-ID: N/A)
CWE-ID: CWE-290 - Authentication Bypass by Spoofing
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to spoof identities.
The vulnerability exists due to authentication bypass by spoofing in ForwardAuth-managed request headers when handling client-supplied header aliases that collapse to the same backend variable name. A remote user can send a specially crafted request with a dot-form header alias to spoof identities.
Exploitation requires the request to be permitted by ForwardAuth first, and impacts backends that normalize distinct header names into the same variable.
Remediation
Install update from vendor's website.