CVE-2026-114636

{
  "etk_id": "ETK-2026-2380",
  "cve_id": "CVE-2026-114636",
  "display_id": "CVE-2026-114636",
  "ghsa_id": "GHSA-754r-9m79-cq7g",
  "euvd_id": "EUVD-2026-107891",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Access-control bypass in Traefik Kubernetes Ingress NGINX provider",
  "summary": "Traefik before 3.7.14 can fail to enforce access-control annotations for ssl-passthrough Ingresses handled through non-TLS HTTP entry points. An unauthenticated remote attacker who can reach the affected HTTP entry point and use the Ingress host may reach backends intended to be protected by authentication, external authorization, or source-range restrictions. Affected requests may not be recorded.",
  "mitigation": "Upgrade Traefik to version 3.7.14. Until upgraded, remove or restrict non-TLS HTTP entry points that expose ssl-passthrough Ingresses, and do not rely solely on the affected Ingress annotations for backend protection.",
  "vendor": "traefik",
  "product": "traefik",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v3.7.13, <= v3.7.13"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v3.7.14"
      ],
      "package_name": "Traefik",
      "purl": "pkg:golang/Traefik"
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.854952433333333,
  "t0_at": "2026-10-22T01:43:37.186000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T08:47:51+00:00",
      "days": -14.705395671296296,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T01:43:37.186000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114636"
    }
  }
}