# CVE-2026-54762: Traefik fail open in Kubernetes Ingress NGINX provider auth resolution

Source: https://junglewise.ai/threats/cve-2026-54762-traefik-fail-open-in-kubernetes-ingress-nginx-provider-auth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-54762 · Severity: medium · CVSS 3.1 · Published 2026-06-23

Traefik is a popular open-source tool used to manage and route web traffic to different services. A security flaw was found where Traefik might accidentally allow anyone to access a service that was supposed to be protected by a password. This happens if Traefik cannot find or read the password file (Secret) it was told to use; instead of blocking access to be safe, it simply opens the service to the public without any password check.

Technologies: [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik), [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2), [github.com/traefik/traefik/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3), [Traefik Labs Traefik Proxy](https://junglewise.ai/threats/technologies/traefik-proxy). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Traefik Labs](https://junglewise.ai/threats/vendors/traefik-labs).

## Quick answers

**Is CVE-2026-54762 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54762 being exploited in the wild.

**How severe is CVE-2026-54762?** Medium severity, with a CVSS score of 3.1, published 23 June 2026.

**Which products and versions are affected?** github.com/traefik/traefik (Go) SEMVER:introduced=0; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0; github.com/traefik/traefik/v3 (Go) >= 3.7.0-ea.1, <= 3.7.4, SEMVER:introduced=3.7.0-ea.1,fixed=3.7.5; Traefik Labs Traefik Proxy >= 3.7.0-ea.1, < 3.7.5, >= 3.7.0-ea.1, <= 3.7.4.

**Is there a fix for CVE-2026-54762?** Yes. github.com/traefik/traefik/v3 (Go): upgrade to 3.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54762 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54762?** Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/traefik/traefik/v3 (Go): upgrade to 3.7.5 or later

  ```sh
  go get github.com/traefik/traefik/v3@v3.7.5
  ```


## Technical details

A 'fail open' vulnerability exists in Traefik's Kubernetes Ingress NGINX provider (pkg/provider/kubernetes/ingress-nginx). When an Ingress resource is configured with 'nginx.ingress.kubernetes.io/auth-type' (Basic or Digest) but the referenced 'auth-secret' is missing, malformed, or inaccessible due to policy, Traefik logs an error but continues to create the route without the required authentication middleware. This occurs because the provider translation logic fails to set 'loc.Error' to true when secret resolution fails, preventing the translator from redirecting the traffic to an 'unavailable-service' or blocking the route. Attackers can reach backend services without authentication if the configuration dependency is broken. The issue is resolved in version 3.7.5.

## Affected products

- traefik traefik >= 3.7.0-ea.1, < 3.7.5

## Identifiers

- CVE-2026-54762
- GHSA-4mr2-fg2p-w63c
- GO-2026-5128

## Timeline

- 2026-06-10: patched: Version 3.7.5 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD

## References

- [https://github.com/traefik/traefik/releases/tag/v3.7.5](https://github.com/traefik/traefik/releases/tag/v3.7.5)
- [https://github.com/traefik/traefik/security/advisories/GHSA-4mr2-fg2p-w63c](https://github.com/traefik/traefik/security/advisories/GHSA-4mr2-fg2p-w63c)

## Related threats

- [Traefik BasicAuth singleflight username enumeration via timing oracle](https://junglewise.ai/threats/cve-2026-88010-traefik-basicauth-singleflight-username-enumeration-via-timing)
- [Traefik readTimeout not enforced on HTTP/3 connections](https://junglewise.ai/threats/cve-2026-88012-traefik-readtimeout-not-enforced-on-http-3-connections)
- [Traefik ForwardAuth identity spoofing via header alias](https://junglewise.ai/threats/cve-2026-88011-traefik-forwardauth-identity-spoofing-via-header-alias)
- [Traefik rootless HTTP/1 request-target routing bypass](https://junglewise.ai/threats/cve-2026-88009-traefik-rootless-http-1-request-target-routing-bypass)
- [Traefik HTTP request smuggling via unrestricted protocol upgrade](https://junglewise.ai/threats/cve-2026-88008-traefik-http-request-smuggling-via-unrestricted-protocol-upgrade)