ETK-2026-972Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-972",
  "cve_id": null,
  "display_id": "ETK-2026-972",
  "ghsa_id": "GHSA-qvj7-gq9c-hp7q",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Access-control bypass in Traefik Kubernetes Ingress NGINX provider",
  "summary": "Traefik v3.7.13 can expose backends from SSL-passthrough Kubernetes Ingress resources through an HTTP route without applying configured authentication or source restrictions. An unauthenticated client may reach an affected backend if it can access the relevant HTTP entry point and target the Ingress host.",
  "mitigation": "Upgrade Traefik to v3.7.14. Until the upgrade is complete, restrict access to affected HTTP entry points or remove SSL passthrough from affected Ingress resources.",
  "vendor": "go",
  "product": "go:Traefik",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v3.7.13, <= v3.7.13"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v3.7.14"
      ],
      "package_name": "Traefik",
      "purl": "pkg:golang/Traefik"
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.623294033333334,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T08:47:51+00:00",
      "days": -13.874698974270833,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:47:25.014083+00:00",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q"
    }
  }
}