Vulnerability in traefik

[ Description ]Official description

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund1 Nov 2026WID-SEC-2026-4271

  Traefik: Multiple vulnerabilities allow bypassing security measures Translated from German

  CVE-2026-119573CVE-2026-119572

[ References ]References

• github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr
• www.vulncheck.com/advisories/traefik-3.7.0-ea.1-before-3.7.15-mtls-bypass-via-ingress-n…