Improper access control in Traefik - #VU145998
Published: August 27, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and other annotation-derived access restrictions.
The vulnerability exists due to improper access control in the Kubernetes ingress-nginx provider sibling router handling when processing requests for an Ingress that combines an authentication annotation with from-to-www-redirect. A remote attacker can send a specially crafted request with a non-numeric or empty port in the Host header to bypass authentication and other annotation-derived access restrictions.
Requests may be forwarded to the protected backend through a sibling router that matches on the host alone and omits annotation-derived middlewares. Paths not present in the Ingress may also be reachable, and the request method is unconstrained.