---
id: "CVE-2026-119573"
kind: "vulnerability"
aliases: ["CVE-2026-119573"]
title: "Traefik: Kubernetes Ingress authorization bypass reads cross-namespace CA secret existence"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kubernetes", "multi-tenant", "traefik"]
not_affected_if: ["no-ingress-nginx-provider", "not-on-3.7.11-to-3.7.14", "single-tenant-cluster"]
published_at: "2026-10-30T14:16:46+00:00"
first_seen_at: "2026-10-30T14:30:54+00:00"
updated_at: "2026-10-30T14:33:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119573", "first_seen_at": "2026-10-30T14:30:54+00:00"}]
---

# Traefik: Kubernetes Ingress authorization bypass reads cross-namespace CA secret existence

Traefik's Kubernetes Ingress NGINX provider skips the cross-namespace check on the auth-tls-secret annotation when a cached TLS option is reused. A user who can create Ingresses can reference another namespace's CA secret and learn whether it exists, without reading its contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Traefik version with `traefik version` or the container image tag.
- Review Ingresses that use the `auth-tls-secret` annotation and see whether any tenant can create Ingresses in shared clusters.

## Fix

- Move Traefik to `3.7.15` or later (the affected range is `3.7.11` before `3.7.15`).

## Timeline

- 2026-10-30T14:30:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119573

## From the sources

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_