---
id: "CVE-2026-114638"
kind: "vulnerability"
aliases: ["CVE-2026-114638"]
title: "Traefik: Kubernetes Ingress NGINX client CA merge lets other CA certificates in"
severity: "high"
cvss: 8.7
epss: 0.00186
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ingress-nginx-provider", "kubernetes", "mutual-tls", "runtime", "traefik"]
not_affected_if: ["no-auth-tls-secret-annotation", "no-kubernetes-ingress-nginx-provider", "not-on-3.7.x", "single-client-ca"]
published_at: "2026-10-22T02:16:56+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114638", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114638", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Traefik: Kubernetes Ingress NGINX client CA merge lets other CA certificates in

Traefik v3.7.0 before v3.7.14 merges client CA certificates when auth-tls-secret names collide after dot-to-dash normalization in the Kubernetes Ingress NGINX provider. An attacker holding a certificate from another host's CA can reach a host that should require its own client CA, while that host's legitimate clients are refused.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the Traefik version with traefik version or the image tag; affected if between v3.7.0 and v3.7.13.
In Kubernetes, look for Ingress resources using the auth-tls-secret annotation whose secret names differ only by dots versus dashes.

## Fix

Upgrade Traefik to v3.7.14 or later.
If you cannot upgrade, give each auth-tls-secret a name that does not collide after dot-to-dash normalization (unverified workaround; the sources do not confirm it).

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114638
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114638

## From the sources

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_