CVE-2026-88877

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.0 through 3.7.11

Description The Kubernetes ingress-nginx provider mishandles Ingresses that contain both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. This causes the provider to create a sibling router that matches only on the host and utilizes the RedirectRegex middleware while pointing to the protected backend service. Since RedirectRegex is not a terminal handler, requests that do not match its pattern are forwarded to the backend. By using a crafted Host header with a non-numeric or empty port (e.g., 'Host: www.example.com:x'), an attacker can select this sibling router and bypass the redirect. This results in the request being proxied to the protected backend without any annotation-derived middlewares being applied, effectively bypassing authentication (such as BasicAuth) and source-IP allowlisting.

Recommendations Update Traefik to version 3.7.12.