{"schema":"threatline.record/2","record":{"id":"GHSA-qvj7-gq9c-hp7q","aliases":["GHSA-qvj7-gq9c-hp7q"],"summary":"Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth","details":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. Since v3.7.13, an Ingress carrying the `nginx.ingress.kubernetes.io/ssl-passthrough: \"true\"` annotation gets, besides its TCP passthrough router, an HTTP router on the non-TLS entry points that proxies to the backend. That router was built outside the regular per-rule processing, so the access-control annotations set on the same Ingress, such as `auth-type` with `auth-secret`, `auth-url` and `whitelist-source-range`, were parsed but never turned into middlewares on it. An unauthenticated client reaching the HTTP entry point with the Ingress host could therefore reach a backend the operator had annotated as protected, with no authentication and no source allow-listing applied, and nothing logged. The HTTP side of an ssl-passthrough Ingress is now built like any other Ingress, with its annotation directives applied; the routers it generates are renamed as a result, see the v3.7.14 migration guide. Traefik v2 and Traefik v3 versions before v3.7.13 are not affected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n","categories":["Unclassified"],"product":"github.com/traefik/traefik/v3","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q","source_modified_at":"2026-10-07T08:47:51Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v3"},"range":">= v3.7.13, <= v3.7.13"}],"fixed_versions":[],"cvss":7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-07T08:47:51Z","modified_at":"2026-10-07T08:47:51Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-10-07T08:47:51Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T08:47:51Z","content_hash":"838cf1d6bed31524f9785377fd728eb1512b43331ed3082afda8b783c0f49b10"}}