Live › vulnerability › CVE-2026-114638
Go to dashboardTraefik v3.7.0 before v3.7.14 merges client CA certificates when auth-tls-secret names collide after dot-to-dash normalization in the Kubernetes Ingress NGINX provider. An attacker holding a certificate from another host's CA can reach a host that should require its own client CA, while that host's legitimate clients are refused.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
v3.7.0 and v3.7.13v3.7.14 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.
This page as .md · .json · in your agent: get_signal("CVE-2026-114638")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.