https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 12:34:55 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-88877 <p>Traefik is a HTTP reverse proxy and load balancer. In versions &gt;= v3.7.0 and &lt;= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional &#39;sibling&#39; router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router&#39;s protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik&#39;s host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example &#39;Host: www.example.com:x&#39;) selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress&#39;s annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.</p> <p>Traefik is a HTTP reverse proxy and load balancer. In versions &gt;= v3.7.0 and &lt;= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional &#39;sibling&#39; router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router&#39;s protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik&#39;s host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example &#39;Host: www.example.com:x&#39;) selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress&#39;s annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.</p> https://db.gcve.eu/vuln/fkie_cve-2026-88877 https://db.gcve.eu/vuln/ghsa-9rch-gvf7-hrfc <p>Traefik is a HTTP reverse proxy and load balancer. In versions &gt;= v3.7.0 and &lt;= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional &#39;sibling&#39; router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router&#39;s protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik&#39;s host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example &#39;Host: www.example.com:x&#39;) selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress&#39;s annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.</p> <p>Traefik is a HTTP reverse proxy and load balancer. In versions &gt;= v3.7.0 and &lt;= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional &#39;sibling&#39; router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router&#39;s protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik&#39;s host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example &#39;Host: www.example.com:x&#39;) selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress&#39;s annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.</p> https://db.gcve.eu/vuln/ghsa-9rch-gvf7-hrfc