AIKIDO-2026-446301

github.com/traefik/traefik/v3 is vulnerable to Authentication Bypass

Authentication BypassGHSA-cjr6-pf59-jq29 Published 5 days ago

High Risk

This Affects:

github.com/traefik/traefik/v3

3.7.0 - 3.7.11

Fixed in 3.7.12

Are you affected? Scan for Free

TL;DR

The Kubernetes ingress-nginx provider's from-to-www-redirect handling builds a sibling router that matches on the host alone, keeps the parent's backend service, and attaches only a RedirectRegex middleware while discarding every annotation-derived middleware including authentication. RedirectRegex is not terminal, and its pattern accepts only numeric ports, so a Host with a non-numeric or empty port selects that sibling, misses the redirect, and is proxied to the protected backend with no auth (and no other annotation middlewares). The fix corrects the redirect handling so fall-through cannot reach the protected backend without those middlewares.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and use the Kubernetes ingress-nginx provider with an Ingress that sets both an authentication (or other annotation-derived) middleware and nginx.ingress.kubernetes.io/from-to-www-redirect.