Description
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| traefik | traefik | 3.7.0-ea.1 – < 3.7.15 | 3.7.15 |
Advisories 1
- WID-SEC-2026-4271 Traefik: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 1, 2026
References
- GitHub Security Advisory (GHSA-p8wx-ph99-xgcr) vendor-advisory
- VulnCheck Advisory: Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider third-party-advisory