# CVE-2026-85596: Traefik Kubernetes Ingress NGINX authentication bypass via TLS option conflict

Source: https://junglewise.ai/threats/cve-2026-85596-traefik-kubernetes-ingress-nginx-authentication-bypass-via-tls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85596 · Severity: critical · CVSS 9.8 · Published 2026-09-04

Traefik is a reverse proxy and load balancer used in Kubernetes environments to route traffic to backend services. A flaw in versions 3.7.0 through 3.7.10 allows attackers to bypass client certificate authentication in Kubernetes Ingress configurations. When two Ingress objects for the same host are configured with mutual TLS authentication, Traefik incorrectly falls back to default settings that do not require client certificates, allowing unauthenticated access to protected routes.

Technologies: [Traefik](https://junglewise.ai/threats/technologies/traefik). Vendors: [Traefik](https://junglewise.ai/threats/vendors/traefik).

## Quick answers

**Is CVE-2026-85596 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85596 being exploited in the wild.

**How severe is CVE-2026-85596?** Critical severity, with a CVSS score of 9.8, published 4 September 2026.

**Which products and versions are affected?** Traefik >=3.7.0, <=3.7.10.

**Is there a fix for CVE-2026-85596?** A patch was published on 2026-08-21: v3.7.11 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85596 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-85596?** Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authentication bypass vulnerability (CWE-287) in Traefik's Kubernetes Ingress NGINX provider. The root cause is that TLS options generated for Ingress objects carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation are named using both the Ingress namespace and name, causing two Ingress objects with identical mTLS policies on the same host to generate different TLS option identifiers. When Traefik detects this as a TLS options conflict on the same SNI/host, it falls back to the entry point's default TLS configuration, which does not request client certificates. An attacker can exploit this by creating a second Ingress object on the same host with the same client CA and authentication mode; no authentication is required as the attack is configuration-driven. The fix in v3.7.11 derives TLS option names from the client CA secret and authentication mode alone, eliminating the conflict. Only v3.7.0 through v3.7.10 are affected; v2 and v3.0–v3.6 do not have the Ingress NGINX provider's client-authentication feature.

## Affected products

- Traefik Traefik >=3.7.0, <=3.7.10

## Timeline

- 2026-09-04: disclosed
- 2026-08-21: patched: v3.7.11 released with fix
- 2026-08-21: advisory: GitHub Security Advisory GHSA-j994-9gqj-9hwq published

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-j994-9gqj-9hwq](https://github.com/traefik/traefik/security/advisories/GHSA-j994-9gqj-9hwq)
- [https://www.vulncheck.com/advisories/traefik-3.7-authentication-bypass-via-tls-option-conflict](https://www.vulncheck.com/advisories/traefik-3.7-authentication-bypass-via-tls-option-conflict)

## Related threats

- [Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate](https://junglewise.ai/threats/cve-2026-121966-traefik-2-x-before-2-11-60-and-3-x-before-3-7-16-sends)
- [Traefik FastProxy data race in HTTP/1 upgrades](https://junglewise.ai/threats/cve-2026-119574-traefik-from-3-2-0-before-3-7-15-contains-a-data-race-in-the)
- [Traefik authentication bypass in TLS options resolution](https://junglewise.ai/threats/cve-2026-114656-traefik-before-2-11-58-and-3-7-13-contains-an-authentication)
- [Traefik NTLM/Kerberos TLS configuration bypass](https://junglewise.ai/threats/cve-2026-114642-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-stores-its)
- [Traefik authentication bypass in backend connection pool](https://junglewise.ai/threats/cve-2026-114639-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-contains)