CVE-2026-54762: Traefik Kubernetes Auth Bypass via Unresolved Secrets

Technical summary

CVE-2026-54762 is a misconfiguration-exposure vulnerability in Traefik's Kubernetes Ingress NGINX provider. The issue arises when an Ingress resource references BasicAuth or DigestAuth through the nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced Secret cannot be resolved (missing, malformed, unreadable, or policy-denied by RBAC). Instead of failing closed—rejecting the request or blocking the route—Traefik logs the error and continues to emit a router to the backend without the middleware chain, effectively bypassing the intended authentication layer. The vulnerability is rooted in CWE-636 (missing authorization) and CWE-693 (protection mechanism failure), resulting in unauthenticated access to protected resources.

Business impact

Organizations running Traefik in Kubernetes environments may inadvertently expose backend services that were intended to be authentication-protected. If an auth Secret is accidentally deleted, misconfigured, or subject to a RBAC policy change, the corresponding routes silently fail open rather than failing secure. This creates a window of exposure where APIs, internal dashboards, or sensitive microservices become accessible without credentials. For multi-tenant or heavily regulated deployments, this represents a compliance risk and a potential avenue for lateral movement or data exfiltration by internal or external actors.

Affected systems

Traefik versions 3.7.0-ea.1 through 3.7.4 are vulnerable when deployed as a Kubernetes Ingress controller and an Ingress resource specifies BasicAuth or DigestAuth via the NGINX-style annotations. Systems using earlier 3.x releases (prior to 3.7.0) or later releases (3.7.5+) are not affected. Vulnerability is contingent on use of the Kubernetes provider with explicit authentication annotations; default or unmodified installations without auth annotations are unaffected.

Exploitability

This is not a remotely exploitable code execution or injection vulnerability. Exploitation requires either (a) an operator configuration error where an auth Secret is misconfigured or deleted, or (b) an attacker who can modify Ingress annotations to introduce an invalid Secret reference, then access the exposed route. In scenarios where auth Secrets are managed by a separate team or automation, a supply-chain style misconfiguration could trigger the vulnerability. The CVSS score of 8.6 reflects the network-accessible nature and high confidentiality impact (unauthenticated data access) even though user interaction and active exploitation are not typically required once the misconfiguration exists.

Remediation

Upgrade Traefik to version 3.7.5 or later. This release includes a fix that ensures Traefik properly handles missing or unresolved auth Secrets by failing the route securely rather than emitting it unauthenticated. After upgrade, validate that routes with auth annotations are correctly protected by verifying that auth middleware is active and unauthenticated requests are rejected. Also audit any recent changes to auth Secrets or Ingress resources to confirm all authentication controls are as intended.

Patch guidance

Apply Traefik 3.7.5 or newer. Review the official Traefik release notes at https://github.com/traefik/traefik/releases to verify the patch version matches your deployment model (Helm chart, Docker, binary, etc.). If using Helm, update the chart to a version pinned to Traefik 3.7.5+. After patching, restart Traefik pods to ensure the updated logic takes effect. Test by deliberately misconfiguring an auth Secret reference and confirming that the route fails closed (unauthenticated requests are blocked) rather than allowing access.

Detection guidance

Review Traefik logs for entries indicating 'secret not found' or 'failed to resolve secret' messages paired with routes that should require authentication. Query your Ingress resources for any that specify nginx.ingress.kubernetes.io/auth-type and nginx.ingress.kubernetes.io/auth-secret annotations and verify that the referenced Secrets exist and are readable by Traefik's service account. Test unauthenticated access to those routes; if successful, the vulnerability is present. Consider implementing a policy that prevents Ingress resources from being admitted unless their auth Secret references resolve before the resource is applied.

Why prioritize this

Although not yet on the CISA KEV catalog, this vulnerability scores 8.6 (HIGH) due to its network-accessible nature and potential for confidentiality breach. The risk is particularly acute for organizations running Traefik in production Kubernetes clusters protecting internal APIs or multi-tenant services. The fix is straightforward (version upgrade), and the blast radius is limited to deployments using explicit NGINX-style auth annotations, making it a high-priority but targeted patch.

Risk score, explained

CVSS 8.6 (HIGH) reflects: Network-accessible attack vector (unauthenticated users on the internet can attempt access), low complexity (no special conditions or multi-step exploitation), no privilege requirement, wide scope (a compromised or misconfigured route affects all downstream services), high confidentiality impact (sensitive data becomes accessible without authentication), and no integrity or availability impact from the vulnerability itself. The score appropriately penalizes the real-world likelihood that operator misconfiguration or Secret management errors will occur in large Kubernetes environments.

Frequently asked questions