{"id":"CVE-2026-119572","kind":"vulnerability","aliases":["CVE-2026-119572"],"related":[],"title":"Traefik: mTLS client certificate check silently skipped on shared Ingress hosts","description":"Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.","summary":"Traefik's Kubernetes Ingress NGINX provider can drop the auth-tls-secret mTLS requirement when another Ingress on the same host and path has no matching auth-tls settings. An unauthenticated attacker can then reach backends that were meant to require client certificates.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ingress","kubernetes","mtls","runtime","traefik"],"not_affected_if":["default-config","no-auth-tls-secret","single-ingress-per-host"],"how_to_check":"- Run `traefik version` or check the image tag to see whether it is between `3.7.0-ea.1` and `3.7.15`.\n- Search Ingress objects for the `auth-tls-secret` annotation and look for other Ingresses on the same host and path without matching auth-tls settings.","fix":"- Move Traefik to `3.7.15` or later.","status":"open","published_at":"2026-10-30T14:16:46+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:32:32+00:00","updated_at":"2026-10-30T14:32:32+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-30T14:32:32Z","model":"claude-haiku-5-5","output":{"fix":"- Move Traefik to `3.7.15` or later.","reach":"internet","title":"Traefik: mTLS client certificate check silently skipped on shared Ingress hosts","impact":"high","summary":"Traefik's Kubernetes Ingress NGINX provider can drop the auth-tls-secret mTLS requirement when another Ingress on the same host and path has no matching auth-tls settings. An unauthenticated attacker can then reach backends that were meant to require client certificates.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["traefik","kubernetes","ingress","mtls"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated clients reach backends that require client certificates","analyst_note":"","how_to_check":"- Run `traefik version` or check the image tag to see whether it is between `3.7.0-ea.1` and `3.7.15`.\n- Search Ingress objects for the `auth-tls-secret` annotation and look for other Ingresses on the same host and path without matching auth-tls settings.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","single-ingress-per-host","no-auth-tls-secret"],"who_is_affected":"Teams running Traefik as a Kubernetes Ingress controller with the Ingress NGINX provider and using auth-tls-secret for mutual TLS. Exposure needs two Ingresses on the same host, one with mTLS and one without matching auth-tls settings, so a single-Ingress setup is less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4183,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119572':14A,17A '-2026':13A,16A '3.7.0':70C '3.7.15':73C 'annot':96C 'anoth':39B,98C 'attack':56B,122C 'auth':33B,51B,93C,110C 'auth-tl':50B,109C 'auth-tls-secret':32B,92C 'authent':76C 'back':115C 'backend':60B,124C 'bypass':77C 'certif':4A,67B,127C 'check':5A 'client':3A,66B,126C 'configur':89C 'contain':74C 'cve':12A,15A 'declar':100C 'default':117C 'disabl':87C 'drop':30B 'ea.1':71C 'fall':114C 'host':11A,44B,106C 'ingress':10A,18B,26B,40B,82C,99C 'kubernet':19B,25B,81C 'let':120C 'match':49B,108C 'meant':63B 'mtls':2A,20B,36B,88C 'nginx':27B,83C 'option':119C 'path':46B,102C 'provid':28B,84C 'reach':59B,123C 'requir':37B,65B,125C 'runtim':21B 'secret':35B,95C 'set':53B,112C 'share':9A 'silent':6A,86C 'skip':7A 'tls':34B,52B,94C,111C,118C 'traefik':1A,22B,23B,68C,113C 'unauthent':55B,121C 'via':90C 'vulner':78C 'without':107C","nicknames":[],"mitigations":[],"who_affected":"Teams running Traefik as a Kubernetes Ingress controller with the Ingress NGINX provider and using auth-tls-secret for mutual TLS. Exposure needs two Ingresses on the same host, one with mTLS and one without matching auth-tls settings, so a single-Ingress setup is less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119572","severity":null,"published_at":"2026-10-30T14:16:46+00:00","modified_at":"2026-10-30T14:16:46+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}