Traefik v3.7.13, before the v3.7.14 release, contains a flaw that allows an attacker to bypass access‑control annotations on HTTP routers for ssl‑passthrough Ingresses accessed via non‑TLS entry points. An unauthenticated actor who can reach the target Ingress host can reach backend services protected by auth‑type, auth‑url, or whitelist‑source‑range annotations, and no request is logged. This flaw permits unauthorized access to protected resources without authentication or accountability.

Vulnerable systems run Traefik v3.7.13 (or earlier) and utilize the Kubernetes Ingress NGINX provider with ssl‑passthrough enabled on hosts that are reachable through the HTTP entry point. All such installations rely on the Ingress annotations for access control, but the router generated for the http entry point never applies those annotations, creating a blind spot. The issue is fixed in v3.7.14 and later releases.

The CVSS score of 7 indicates a high severity. EPSS information is not available, so the exploitation probability cannot be quantified. The flaw does not require special privileges; an attacker must simply be able to resolve the Ingress host and direct traffic to the HTTP port configured for ssl‑passthrough. Because no logs are recorded, attackers can reuse the bypass repeatedly and remain undetected.