Vvvvvvvvvvel

A fail-open authentication issue exists in the Kubernetes Ingress NGINX provider. When an Ingress explicitly enables BasicAuth or DigestAuth using the `nginx.ingress.kubernetes.io/auth-type` and `nginx.ingress.kubernetes.io/auth-secret` annotations, but the referenced auth Secret is missing, malformed, unreadable, or denied by policy, the system fails to apply the necessary security controls. Instead of blocking access, Traefik logs the resolution error, skips the installation of the authentication middleware, and still creates a router to the backend service. This allows unauthenticated access to backend services that operators intended to protect.

An issue exists in the Kubernetes Gateway provider regarding the `crossProviderNamespaces` allowlist. When `HTTPRoute` rules declare multiple backendRefs (Weighted Round Robin), the system evaluates the allowlist against the target `backendRef.namespace` instead of the namespace of the route itself. This allows an `HTTPRoute` created in a non-allow-listed namespace to reference internal cross-provider `TraefikService` components, such as `api@internal`, `dashboard@internal`, or `rest@internal`, by pointing the `backendRef.namespace` to an allow-listed namespace that has a matching Gateway API `ReferenceGrant`. This results in the exposure of internal Traefik services on the data plane. Exploitation requires the ability to create an accepted `HTTPRoute` and a corresponding `ReferenceGrant` from an allow-listed namespace.