Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck
CVE-2026-85596Traefik v3.7 Authentication Bypass via TLS Option Conflict
High 8.2
In plain English
A high-severity improper authentication in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- GitHub Security Advisory (GHSA-j994-9gqj-9hwq) vendor-advisory
- VulnCheck Advisory: Traefik v3.7 Authentication Bypass via TLS Option Conflict third-party-advisory