CVE-2026-54762: Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Vulnerability summary

CVE-2026-54762 is a high (CVSS 8.6) Failing Open vulnerability in traefik. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-06-2026
   PublishedVulnerability first disclosed.
2. 24-06-2026
   Last modifiedVulnerability information updated.

Description

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the referenced auth Secret cannot be resolved or parsed, Traefik logs the resolution error, skips installing the authentication middleware, and still emits a router to the backend service. A route that operators intended to protect is therefore published to the data plane without its authentication control, allowing unauthenticated access to the backend. The trigger is an invalid or unresolved auth dependency — a missing, malformed, unreadable, or policy-denied Secret — rather than an intentionally unprotected route. This vulnerability is fixed in 3.7.5.

• CWE-636Not Failing Securely ('Failing Open')When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
• CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.