v3.7.5

EricLBuehler/diffusion-rsv3.7.5Jun 10, 2026by github-actions[bot]

AI Summary

Fixes two critical security vulnerabilities (CVEs) and addresses various bug fixes in ingress-nginx, gatewayapi, server, and TLS components.

Key Highlights

Fixes CVE-2026-54761 and CVE-2026-54762
Skips ingress when auth-secret resolution fails
Passes endpointslice fencing on ingress-nginx provider
Fixes routers with same host, different tlsoptions
Fixes snicheck for routers with no hosts

New Features

Security vulnerability patches
Ingress-nginx provider improvements
GatewayAPI reference validation
Server TLS configuration fixes

Full Release Notes

**CVE fixed:**
- [CVE-2026-54761](https://nvd.nist.gov/vuln/detail/CVE-2026-54761) (Advisory [GHSA-3g6v-2r68-prfc](https://github.com/traefik/traefik/security/advisories/GHSA-3g6v-2r68-prfc))
- [CVE-2026-54762](https://nvd.nist.gov/vuln/detail/CVE-2026-54762) (Advisory [GHSA-4mr2-fg2p-w63c](https://github.com/traefik/traefik/security/advisories/GHSA-4mr2-fg2p-w63c))

**Bug fixes:**
- **[k8s/ingress-nginx]** Skip ingress when auth-secret resolution fails ([#13323](https://github.com/traefik/traefik/pull/13323) @gndz07)
- **[k8s/ingress-nginx]** Pass endpointslice fencing on ingress-nginx provider ([#13290](https://github.com/traefik/traefik/pull/13290) @Learloj)
- **[k8s/gatewayapi]** Reject cross-provider references with backendRefs.namespace ([#13322](https://github.com/traefik/traefik/pull/13322) @youkoulayley)
- **[server]** Bump to github.com/pires/go-proxyproto v0.12.0 ([#13313](https://github.com/traefik/traefik/pull/13313) @timschumi)
- **[tls]** Fix routers with same host, different tlsoptions on different entryPoint ([#13329](https://github.com/traefik/traefik/pull/13329) @juliens)
- **[tls]** Fix snicheck for routers with no hosts ([#13333](https://github.com/traefik/traefik/pull/13333) @rtribotte)