{"id":"CVE-2026-119573","kind":"vulnerability","aliases":["CVE-2026-119573"],"related":[],"title":"Traefik: Kubernetes Ingress authorization bypass reads cross-namespace CA secret existence","description":"Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.","summary":"Traefik's Kubernetes Ingress NGINX provider skips the cross-namespace check on the auth-tls-secret annotation when a cached TLS option is reused. A user who can create Ingresses can reference another namespace's CA secret and learn whether it exists, without reading its contents.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","multi-tenant","traefik"],"not_affected_if":["no-ingress-nginx-provider","not-on-3.7.11-to-3.7.14","single-tenant-cluster"],"how_to_check":"- Check the Traefik version with `traefik version` or the container image tag.\n- Review Ingresses that use the `auth-tls-secret` annotation and see whether any tenant can create Ingresses in shared clusters.","fix":"- Move Traefik to `3.7.15` or later (the affected range is `3.7.11` before `3.7.15`).","status":"open","published_at":"2026-10-30T14:16:46+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:33:02+00:00","updated_at":"2026-10-30T14:33:02+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-30T14:33:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move Traefik to `3.7.15` or later (the affected range is `3.7.11` before `3.7.15`).","reach":"network","title":"Traefik: Kubernetes Ingress authorization bypass reads cross-namespace CA secret existence","impact":"low","summary":"Traefik's Kubernetes Ingress NGINX provider skips the cross-namespace check on the auth-tls-secret annotation when a cached TLS option is reused. A user who can create Ingresses can reference another namespace's CA secret and learn whether it exists, without reading its contents.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["traefik","kubernetes","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker learns whether a cross-namespace CA secret exists","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` or the container image tag.\n- Review Ingresses that use the `auth-tls-secret` annotation and see whether any tenant can create Ingresses in shared clusters.","plain_action":"","needs_analyst":false,"not_affected_if":["single-tenant-cluster","no-ingress-nginx-provider","not-on-3.7.11-to-3.7.14"],"who_is_affected":"Clusters running Traefik 3.7.11 through 3.7.14 with the Kubernetes Ingress NGINX provider, where users other than cluster admins can create Ingresses. Single-tenant clusters where only trusted operators create Ingresses carry much less risk. The sources do not describe whether the default configuration enables the affected provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":4184,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119573':15A,18A '-2026':14A,17A '3.7.11':74C '3.7.15':76C 'alreadi':122C 'annot':43B,100C 'anoth':59B,117C,125C 'auth':40B,97C 'auth-tls-secret':39B,96C 'authent':105C 'author':4A,79C 'bypass':5A,80C 'ca':10A,62B,120C 'cach':46B,103C 'check':36B,93C 'client':104C 'contain':77C 'content':72B,142C 'creat':55B,113C 'cross':8A,34B,91C 'cross-namespac':7A,33B,90C 'cve':13A,16A 'disclosur':139C 'enforc':127C 'exist':12A,68B,137C 'infrastructur':19B 'ingress':3A,28B,56B,84C,114C,126C 'kubernet':2A,20B,27B,83C 'learn':65B,134C 'multi':22B 'multi-ten':21B 'namespac':9A,35B,60B,92C,118C 'nginx':29B,85C 'option':48B,107C 'provid':30B,86C 'read':6A,70B 'refer':58B,116C 'reus':50B,109C 'rout':132C 'secret':11A,42B,63B,99C,121C 'skip':31B,88C 'tenant':23B 'tls':41B,47B,98C,106C 'traefik':1A,24B,25B,73C 'use':123C 'user':52B,110C 'whether':66B,135C 'without':69B,138C","nicknames":[],"mitigations":[],"who_affected":"Clusters running Traefik 3.7.11 through 3.7.14 with the Kubernetes Ingress NGINX provider, where users other than cluster admins can create Ingresses. Single-tenant clusters where only trusted operators create Ingresses carry much less risk. The sources do not describe whether the default configuration enables the affected provider.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119573","severity":null,"published_at":"2026-10-30T14:16:46+00:00","modified_at":"2026-10-30T14:16:46+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}