Live › vulnerability › CVE-2026-119573
Traefik's Kubernetes Ingress NGINX provider skips the cross-namespace check on the auth-tls-secret annotation when a cached TLS option is reused. A user who can create Ingresses can reference another namespace's CA secret and learn whether it exists, without reading its contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Clusters running Traefik 3.7.11 through 3.7.14 with the Kubernetes Ingress NGINX provider, where users other than cluster admins can create Ingresses. Single-tenant clusters where only trusted operators create Ingresses carry much less risk. The sources do not describe whether the default configuration enables the affected provider.
No product ranges from the sources yet.
traefik version or the container image tag.auth-tls-secret annotation and see whether any tenant can create Ingresses in shared clusters.3.7.15 or later (the affected range is 3.7.11 before 3.7.15).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.
This page as .md · .json · in your agent: get_signal("CVE-2026-119573")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.