Live › vulnerability › CVE-2026-114640
Go to dashboardTraefik's Kubernetes Ingress-NGINX provider trusts client-supplied Ssl-Client-* headers on its plaintext HTTP router. An unauthenticated attacker can send Ssl-Client-Verify: SUCCESS with a chosen subject and issuer to impersonate any mTLS identity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
3.7.0 or later; the flaw is in v3.7.0 before v3.7.14v3.7.14 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.
This page as .md · .json · in your agent: get_signal("CVE-2026-114640")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.