CVE-2026-54762

The record

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency — a missing, malformed, unreadable, or policy-denied Secret — rather than an intentionally unprotected route. This vulnerability is fixed in 3.7.5.

Affected packages

Related vulnerabilities

• CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed… CWE-636
• CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthorized… CWE-636
• CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password… CWE-636
• CVE-2026-18329 Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a… CWE-636
• CVE-2026-82744 Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor… CWE-636
• CVE-2026-46482 ### Impact The registration component does not validate the text-based _Security… CWE-636
• CVE-2026-70452 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows… CWE-636
• CVE-2026-54291 pgjdbc is an open source postgresql JDBC Driver. CWE-636