Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M

CVE-2025-66491Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider

Medium 5.9

In plain English

A medium-severity improper certificate validation in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/traefik/traefik	no fix listed	GO-2025-4205
Go	github.com/traefik/traefik/v2	no fix listed	GO-2025-4205
Go	github.com/traefik/traefik/v3	3.6.3	GHSA-7vww-mvcr-x6vj
Go	github.com/traefik/traefik/v3	3.6.3	GO-2025-4205

Affected products (as reported)

Vendor	Product	Versions
traefik	traefik	>= 3.5.0, < 3.6.3

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj x_refsource_CONFIRM
https://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4 x_refsource_MISC
https://github.com/traefik/traefik/releases/tag/v3.6.3 x_refsource_MISC