The vulnerability occurs in Traefik releases 3.7.0 through 3.7.11 when the Kubernetes ingress-nginx provider processes Ingress resources that contain both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider creates an additional sibling router that matches only on the host and applies a RedirectRegex middleware. Because the RedirectRegex middleware is not terminal, requests that do not match its pattern are forwarded to the backend service. The redirect pattern accepts only numeric ports, but Traefik canonicalizes host headers with net.SplitHostPort, permitting an attacker to send a request with a non-numeric or empty port (e.g., “Host: www.example.com:x”). This request selects the sibling router, skips the redirect, and reaches the protected backend without any of the authentication or other annotation‑derived middlewares. Consequently authentication and source‑IP allowlisting are bypassed, allowing unauthorized access to the backend service. This is an Auth‑Breach type flaw identified as CWE‑639.

The affected product is Traefik, an HTTP reverse proxy and load balancer, when deployed with the Kubernetes ingress-nginx provider. Versions from 3.7.0 up to and including 3.7.11 are vulnerable. Traefik versions before 3.7.0 and Traefik v2 releases are not affected. The issue is addressed starting with Traefik 3.7.12.

With a CVSS score of 9.3 the vulnerability is classified as critical. No EPSS data is available at the time of this analysis, but the lack of restrictions on the attack surface – any user able to issue HTTP requests to the affected Ingress – makes exploitation likely. The issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an adversary can craft a Host header with a non‑numeric or empty port to trigger the bypass, sending the request directly to the protected backend over the network.