# CVE-2026-114640: Traefik Ingress-NGINX mTLS identity spoofing via forged headers

Source: https://junglewise.ai/threats/cve-2026-114640-traefik-from-v3-7-0-before-v3-7-14-contains-an-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114640 · Severity: high · CVSS 8.7 · Published 2026-10-22

Traefik is a reverse proxy and load balancer used to route traffic to services in Kubernetes clusters. When configured with the Ingress-NGINX provider and specific authentication settings, an unauthenticated attacker can forge SSL/TLS client identity headers to impersonate legitimate mTLS-authenticated clients, bypassing authentication controls. This allows an attacker to gain unauthorized access to backend services that trust these headers for access control.

Technologies: [Traefik Labs Traefik](https://junglewise.ai/threats/technologies/traefik-labs-traefik). Vendors: [Traefik Labs](https://junglewise.ai/threats/vendors/traefik-labs).

## Quick answers

**Is CVE-2026-114640 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114640 being exploited in the wild.

**How severe is CVE-2026-114640?** High severity, with a CVSS score of 8.7, published 22 October 2026.

**Which products and versions are affected?** Traefik Labs Traefik v3.7.0 through v3.7.13.

**Is there a fix for CVE-2026-114640?** Yes: fixed in v3.7.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114640 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114640?** Check whether you run Traefik Labs Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v3.7.14

## Technical details

The vulnerability exists in Traefik v3.7.0 through v3.7.13 when the Ingress-NGINX provider is used with both the auth-tls-pass-certificate-to-upstream annotation and ssl-redirect disabled. The middleware that validates and forwards Ssl-Client-* headers is only attached to the TLS router; the plaintext HTTP router forwards client-supplied headers without validation. An attacker sends Ssl-Client-Verify: SUCCESS with a forged certificate subject and issuer to spoof an mTLS identity. Attack vector is network-based with no authentication or user interaction required.

## Affected products

- Traefik Labs Traefik v3.7.0 through v3.7.13

## Timeline

- 2026-10-07: disclosed
- 2026-10-21: advisory
- 2026-10-22: patched

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6](https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6)
- [https://www.vulncheck.com/advisories/traefik-3.7.0-before-3.7.14-mtls-header-spoofing-via-ingress-nginx-http-router](https://www.vulncheck.com/advisories/traefik-3.7.0-before-3.7.14-mtls-header-spoofing-via-ingress-nginx-http-router)

## Related threats

- [Traefik authorization bypass in Kubernetes Ingress NGINX provider](https://junglewise.ai/threats/cve-2026-119573-traefik-3-7-11-before-3-7-15-contains-an-authorization-bypass-in)
- [Traefik ingress-nginx provider mTLS authentication bypass](https://junglewise.ai/threats/cve-2026-119572-traefik-from-3-7-0-ea-1-before-3-7-15-contains-an-authentication)
- [Traefik Kubernetes Ingress NGINX provider authentication bypass via TLS secret name collision](https://junglewise.ai/threats/cve-2026-114638-traefik-v3-7-0-before-v3-7-14-contains-an-improper)
- [Traefik FastProxy NTLM/Negotiate authentication bypass in connection pool](https://junglewise.ai/threats/cve-2026-114637-traefik-from-v3-2-0-before-v3-7-14-contains-an-authentication)
- [Traefik Kubernetes Ingress NGINX provider access-control bypass in ssl-passthrough](https://junglewise.ai/threats/cve-2026-114636-traefik-v3-7-13-before-v3-7-14-contains-an-access-control-bypass)