CVE-2026-54762

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.0-ea.1 through 3.7.4

Description A fail-open authentication issue exists in the Kubernetes Ingress NGINX provider. When an Ingress explicitly enables BasicAuth or DigestAuth using the nginx.ingress.kubernetes.io/auth-type and nginx.ingress.kubernetes.io/auth-secret annotations, but the referenced auth Secret is missing, malformed, unreadable, or denied by policy, the system fails to apply the necessary security controls. Instead of blocking access, Traefik logs the resolution error, skips the installation of the authentication middleware, and still creates a router to the backend service. This allows unauthenticated access to backend services that operators intended to protect.

Recommendations Update to version 3.7.5.