CVE-2026-114636
Description
A flaw was found in Traefik. This vulnerability allows an unauthenticated remote attacker to bypass access control restrictions. When handling Kubernetes Ingress resources configured for SSL (Secure Sockets Layer) passthrough, the HTTP router generated on non-TLS (Transport Layer Security) entry points fails to apply access-control annotations. Consequently, an attacker can access backend services protected by authentication mechanisms or IP (Internet Protocol) allowlists without being logged.
Statement
Red Hat Product Security rates this vulnerability as an Important severity risk because unauthenticated remote attackers can circumvent security annotations and access protected backends over the network without detection. Red Hat platforms, including Red Hat Enterprise Linux and Red Hat OpenShift, do not package or deploy Traefik, relying instead on alternate ingress and proxy solutions. Exploitation is further constrained to environments exposing SSL-passthrough ingress resources over unencrypted HTTP entry points with access-control rules defined.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
