A critical authentication bypass vulnerability in Traefik allows unauthenticated remote attackers to circumvent security controls and access protected backend services.

This vulnerability, categorized as an authorization bypass (CWE-639), occurs when specific ingress annotations cause the creation of a misconfigured sibling router. An unauthenticated attacker can trigger this by crafting a request with a non-numeric or empty port in the Host header, causing the proxy to bypass authentication and IP allowlisting entirely.

The potential impact is severe, as successful exploitation results in total bypass of authentication mechanisms and security policies. With a CVSS score of 9.8, this vulnerability poses a critical threat to data confidentiality and integrity, as unauthorized actors can gain direct access to sensitive backend services that were intended to be protected by BasicAuth or IP-based restrictions.

Immediate Action: Update Traefik to version 3.7.12 or later immediately to apply the fix for the ingress-nginx provider configuration.

Proactive Monitoring: Review web access logs for anomalous Host header patterns, particularly those containing non-standard port syntax or unexpected characters, which may indicate exploitation attempts.

Compensating Controls: Implement strict input validation at the edge or utilize a Web Application Firewall to block requests containing malformed Host headers until the patch is deployed.

Public Exploit Available: Unknown

Given the critical severity and the potential for complete bypass of security controls, organizations utilizing Traefik in Kubernetes environments must prioritize this update. Verify your current version, and if you are running any release between 3.7.0 and 3.7.13, proceed with an immediate upgrade to version 3.7.12 or the latest stable release to eliminate this attack vector.