GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-28hp-c82p-8vqj · Package
FIX → v3.7.15
With the default settings, Traefik's Kubernetes Ingress NGINX provider checks cross-namespace access only when it first builds a client-auth TLS option, so a later Ingress can reuse a CA secret from another namespace without the check. An attacker who can create Ingresses in one namespace can enforce another namespace's CA secret on their routes and learn whether that secret exists; the secret contents are not disclosed.
first public Oct 16, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clusters running Traefik v3.7.11 through v3.7.14 with the Kubernetes Ingress NGINX provider enabled, where users can create Ingresses in some namespaces. Traefik v3.7.10 and earlier and Traefik v2 are not affected. Exposure is limited to users who can create Ingresses and only in the sense of learning a secret's existence and using its CA for their own routes.
Not affected if default-config-allowcrossnamespaceresources-disabled-but-no-shared-tls, traefik-v2, version-before-3.7.11
Who cares kubernetes, self-hosted, traefik
traefik version or check the image tag to see whether the running version is between v3.7.11 and v3.7.14.allowCrossNamespaceResources is set to true in the Traefik configuration; the default is disabled.nginx.ingress.kubernetes.io/auth-tls-secret annotation.There is a low severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. With allowCrossNamespaceResources disabled (the default), the cross-namespace check on the nginx.ingress.kubernetes.io/auth-tls-secret annotation only runs when a client authentication TLS option is first built: a later Ingress referencing a CA secret already used by another Ingress reuses the shared TLS option without being checked. A user allowed to create Ingresses in one namespace can therefore have a CA secret from another namespace enforced as the client certificate authority of their own routes, bypassing the configured namespace isolation, and learn whether that secret exists and is in use; the secret's contents are not disclosed. The issue was introduced in v3.7.11, when client authentication TLS options started being shared across Ingresses; earlier versions are not affected, and Traefik v2 is not affected since it does not include the Kubernetes Ingress NGINX provider.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v3.7.15
v3.7.15.