Executive brief
Traefik is a popular open-source tool used to manage and route web traffic to different services. A security flaw was found where Traefik might accidentally allow anyone to access a service that was supposed to be protected by a password. This happens if Traefik cannot find or read the password file (Secret) it was told to use; instead of blocking access to be safe, it simply opens the service to the public without any password check.
Technical details
A 'fail open' vulnerability exists in Traefik's Kubernetes Ingress NGINX provider (pkg/provider/kubernetes/ingress-nginx). When an Ingress resource is configured with 'nginx.ingress.kubernetes.io/auth-type' (Basic or Digest) but the referenced 'auth-secret' is missing, malformed, or inaccessible due to policy, Traefik logs an error but continues to create the route without the required authentication middleware. This occurs because the provider translation logic fails to set 'loc.Error' to true when secret resolution fails, preventing the translator from redirecting the traffic to an 'unavailable-service' or blocking the route. Attackers can reach backend services without authentication if the configuration dependency is broken. The issue is resolved in version 3.7.5.
Affected products
- traefik traefik >= 3.7.0-ea.1, < 3.7.5
Timeline
- 2026-06-10: patched: Version 3.7.5 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD