External risk intelligence

Traefik Kubernetes Ingress Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-88877

Traefik is a widely used HTTP reverse proxy and load balancer typically deployed at the network edge. As an ingress controller in Kubernetes, it is explicitly designed to handle, route, and secure public-facing internet traffic to backend services, making this vulnerability directly exposed in standard deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves Traefik, a widely used HTTP reverse proxy and load balancer, particularly when used with Kubernetes. It allows unauthenticated access to protected services by bypassing security controls like authentication and IP allowlisting. The main concern is confirming relevance and exposure within your specific environment.

Bypasses security on network traffic routing.
Crucial for any edge network service protection.
Confirm if this affects our deployed services.

Attack Path

How an attacker could exploit the issue

An attacker could target Traefik instances by sending specially crafted HTTP requests. If Traefik is configured with both an authentication annotation and a specific redirect annotation on an Ingress resource, certain requests can bypass the intended security measures. This occurs when a request targets a host but includes a non-standard or empty port, which causes Traefik to improperly process the request. This bypass can result in unauthorized access to backend services and the unintended application of network traffic.

Entry condition: Publicly accessible Traefik instance.
Trigger point: Malformed `Host` header in HTTP request.
Resulting risk: Authentication and security bypass.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, Traefik's Kubernetes ingress-nginx provider could allow unauthenticated access to backend services for requests with specific host header formats. This bypasses security controls like authentication and IP allowlisting.

Backend services could be exposed.
Malformed host headers could trigger the bypass.
Unauthenticated access to protected services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Traefik's Kubernetes ingress-nginx provider, which can bypass authentication and IP allowlisting, requires immediate attention from platform and security teams. The first practical step is to identify all Traefik instances, verify their specific versions, and determine exposure through ingress rules. Once identified and confirmed as critical, a risk-based remediation plan, potentially involving vendor coordination or temporary mitigations, should be executed.

Platform and Security teams own the issue.
Verify Traefik versions and ingress configurations.
Plan and execute version updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Traefik?

Traefik is a modern HTTP reverse proxy and load balancer designed to sit in front of web applications. In cloud-native environments like Kubernetes, it acts as an ingress controller, serving as a gateway that manages, routes, and secures traffic flowing from the internet into various backend services. It is commonly used to automate how services are discovered and exposed.

What is the vulnerability in CVE-2026-88877?

This issue is classified under CWE-639, which involves authorization bypass. It occurs because Traefik incorrectly handles specific combinations of ingress annotations. When configured with both authentication and www-redirect rules, the system can create a logic error that accidentally drops security controls. This allows incoming requests to reach backend services without being checked by authentication or IP filtering policies.

How does an attacker trigger this bypass?

An attacker triggers this by sending an HTTP request with a malformed Host header—specifically one containing an empty or non-numeric port, such as 'www.example.com:x'. This forces the proxy to route the request through a 'sibling' path that ignores the intended security middlewares. If the request uses a standard, valid port, this specific bypass condition is not triggered.

Is my deployment at risk?

According to Halo Surface Signal, this vulnerability is very likely to affect standard deployments because Traefik is typically placed at the network edge to handle public internet traffic. If your instance is internet-facing and uses the affected Kubernetes ingress-nginx provider with the specific combination of authentication and redirect annotations, your protected backend services may be reachable by unauthorized parties.

How do I address CVE-2026-88877?

First, audit your environment to locate all running Traefik instances and verify their specific software version. If you are using a version between 3.7.0 and 3.7.11, prioritize upgrading to version 3.7.12 or later, which contains the official fix. If an immediate update is not possible, review your Kubernetes ingress resources to identify and temporarily adjust configurations that combine authentication and redirect annotations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.