# CVE-2026-119573: Traefik authorization bypass in Kubernetes Ingress NGINX provider

Source: https://junglewise.ai/threats/cve-2026-119573-traefik-3-7-11-before-3-7-15-contains-an-authorization-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119573 · Severity: medium · CVSS 4.4 · Published 2026-10-30

Traefik is a reverse proxy and ingress controller used to route traffic to applications in Kubernetes clusters. A flaw in versions 3.7.11 through 3.7.14 allows users with permission to create Ingresses in one namespace to bypass namespace isolation and reuse TLS certificates from other namespaces, discovering whether secrets exist in other namespaces. While the contents of the secrets are not exposed, this undermines the namespace isolation security model.

Technologies: [Traefik Labs Traefik](https://junglewise.ai/threats/technologies/traefik-labs-traefik). Vendors: [Traefik Labs](https://junglewise.ai/threats/vendors/traefik-labs).

## Quick answers

**Is CVE-2026-119573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119573 being exploited in the wild.

**How severe is CVE-2026-119573?** Medium severity, with a CVSS score of 4.4, published 30 October 2026.

**Which products and versions are affected?** Traefik Labs Traefik 3.7.11 through 3.7.14.

**Is there a fix for CVE-2026-119573?** Yes: fixed in 3.7.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119573 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119573?** Check whether you run Traefik Labs Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.7.15

## Technical details

The vulnerability is an authorization bypass (CWE-863) in the Kubernetes Ingress NGINX provider's cross-namespace validation for the auth-tls-secret annotation. When a client authentication TLS option is cached and reused across Ingresses, the cross-namespace authorization check—which normally runs only on first use—is skipped. An attacker with Ingress creation privileges can reference a CA secret from another namespace that was previously cached, bypassing namespace isolation and learning of the secret's existence without accessing its contents.

## Affected products

- Traefik Labs Traefik 3.7.11 through 3.7.14

## Timeline

- 2026-10-16: disclosed
- 2026-10-30: advisory

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj](https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj)
- [https://www.vulncheck.com/advisories/traefik-3.7.11-before-3.7.15-cross-namespace-authorization-bypass-via-auth-tls-secret](https://www.vulncheck.com/advisories/traefik-3.7.11-before-3.7.15-cross-namespace-authorization-bypass-via-auth-tls-secret)

## Related threats

- [Traefik ingress-nginx provider mTLS authentication bypass](https://junglewise.ai/threats/cve-2026-119572-traefik-from-3-7-0-ea-1-before-3-7-15-contains-an-authentication)
- [Traefik Ingress-NGINX mTLS identity spoofing via forged headers](https://junglewise.ai/threats/cve-2026-114640-traefik-from-v3-7-0-before-v3-7-14-contains-an-authentication)
- [Traefik Kubernetes Ingress NGINX provider authentication bypass via TLS secret name collision](https://junglewise.ai/threats/cve-2026-114638-traefik-v3-7-0-before-v3-7-14-contains-an-improper)
- [Traefik FastProxy NTLM/Negotiate authentication bypass in connection pool](https://junglewise.ai/threats/cve-2026-114637-traefik-from-v3-2-0-before-v3-7-14-contains-an-authentication)
- [Traefik Kubernetes Ingress NGINX provider access-control bypass in ssl-passthrough](https://junglewise.ai/threats/cve-2026-114636-traefik-v3-7-13-before-v3-7-14-contains-an-access-control-bypass)