CVE-2026-54762: Traefik fail open in Kubernetes Ingress NGINX provider auth resolution

CVE-2026-54762 · Severity: medium · CVSS 3.1 · Published 2026-06-23

Traefik is a popular open-source tool used to manage and route web traffic to different services. A security flaw was found where Traefik might accidentally allow anyone to access a service that was supposed to be protected by a password. This happens if Traefik cannot find or read the password file (Secret) it was told to use; instead of blocking access to be safe, it simply opens the service to the public without any password check.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-54762 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54762 being exploited in the wild.
How severe is CVE-2026-54762?
Medium severity, with a CVSS score of 3.1, published 23 June 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) >= 3.7.0-ea.1, <= 3.7.4, SEMVER:introduced=3.7.0-ea.1,fixed=3.7.5; Traefik Labs Traefik Proxy >= 3.7.0-ea.1, < 3.7.5, >= 3.7.0-ea.1, <= 3.7.4.
Is there a fix for CVE-2026-54762?
Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54762 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54762?
Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/traefik/traefik/v3 (Go): upgrade to 3.7.5 or later
    go get github.com/traefik/traefik/v3@v3.7.5

Technical details

A 'fail open' vulnerability exists in Traefik's Kubernetes Ingress NGINX provider (pkg/provider/kubernetes/ingress-nginx). When an Ingress resource is configured with 'nginx.ingress.kubernetes.io/auth-type' (Basic or Digest) but the referenced 'auth-secret' is missing, malformed, or inaccessible due to policy, Traefik logs an error but continues to create the route without the required authentication middleware. This occurs because the provider translation logic fails to set 'loc.Error' to true when secret resolution fails, preventing the translator from redirecting the traffic to an 'unavailable-service' or blocking the route. Attackers can reach backend services without authentication if the configuration dependency is broken. The issue is resolved in version 3.7.5.

Affected products

  • traefik traefik >= 3.7.0-ea.1, < 3.7.5

Identifiers

  • CVE-2026-54762
  • GHSA-4mr2-fg2p-w63c
  • GO-2026-5128

Timeline

  • 2026-06-10: patched: Version 3.7.5 released
  • 2026-06-19: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.