Executive brief
Traefik is a reverse proxy and load balancer used in Kubernetes environments to route traffic to backend services. A flaw in versions 3.7.0 through 3.7.10 allows attackers to bypass client certificate authentication in Kubernetes Ingress configurations. When two Ingress objects for the same host are configured with mutual TLS authentication, Traefik incorrectly falls back to default settings that do not require client certificates, allowing unauthenticated access to protected routes.
Technical details
This is an authentication bypass vulnerability (CWE-287) in Traefik's Kubernetes Ingress NGINX provider. The root cause is that TLS options generated for Ingress objects carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation are named using both the Ingress namespace and name, causing two Ingress objects with identical mTLS policies on the same host to generate different TLS option identifiers. When Traefik detects this as a TLS options conflict on the same SNI/host, it falls back to the entry point's default TLS configuration, which does not request client certificates. An attacker can exploit this by creating a second Ingress object on the same host with the same client CA and authentication mode; no authentication is required as the attack is configuration-driven. The fix in v3.7.11 derives TLS option names from the client CA secret and authentication mode alone, eliminating the conflict. Only v3.7.0 through v3.7.10 are affected; v2 and v3.0–v3.6 do not have the Ingress NGINX provider's client-authentication feature.
Affected products
- Traefik Traefik >=3.7.0, <=3.7.10
Timeline
- 2026-09-04: disclosed
- 2026-08-21: patched: v3.7.11 released with fix
- 2026-08-21: advisory: GitHub Security Advisory GHSA-j994-9gqj-9hwq published