Live › vulnerability › CVE-2026-119572
Traefik's Kubernetes Ingress NGINX provider can drop the auth-tls-secret mTLS requirement when another Ingress on the same host and path has no matching auth-tls settings. An unauthenticated attacker can then reach backends that were meant to require client certificates.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams running Traefik as a Kubernetes Ingress controller with the Ingress NGINX provider and using auth-tls-secret for mutual TLS. Exposure needs two Ingresses on the same host, one with mTLS and one without matching auth-tls settings, so a single-Ingress setup is less exposed.
No product ranges from the sources yet.
traefik version or check the image tag to see whether it is between 3.7.0-ea.1 and 3.7.15.auth-tls-secret annotation and look for other Ingresses on the same host and path without matching auth-tls settings.3.7.15 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.
This page as .md · .json · in your agent: get_signal("CVE-2026-119572")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.