{"id":"GHSA-28hp-c82p-8vqj","kind":"vulnerability","aliases":["GHSA-28hp-c82p-8vqj"],"related":[],"title":"Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret","description":"## Summary\n\nThere is a low severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. With `allowCrossNamespaceResources` disabled (the default), the cross-namespace check on the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation only runs when a client authentication TLS option is first built: a later Ingress referencing a CA secret already used by another Ingress reuses the shared TLS option without being checked. A user allowed to create Ingresses in one namespace can therefore have a CA secret from another namespace enforced as the client certificate authority of their own routes, bypassing the configured namespace isolation, and learn whether that secret exists and is in use; the secret's contents are not disclosed. The issue was introduced in v3.7.11, when client authentication TLS options started being shared across Ingresses; earlier versions are not affected, and Traefik v2 is not affected since it does not include the Kubernetes Ingress NGINX provider.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.15\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"With the default settings, Traefik's Kubernetes Ingress NGINX provider checks cross-namespace access only when it first builds a client-auth TLS option, so a later Ingress can reuse a CA secret from another namespace without the check. An attacker who can create Ingresses in one namespace can enforce another namespace's CA secret on their routes and learn whether that secret exists; the secret contents are not disclosed.","severity":"low","cvss":2.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.15"],"affected":">= v3.7.11, <= v3.7.14","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-863","kubernetes","package","self-hosted","traefik"],"not_affected_if":["default-config-allowcrossnamespaceresources-disabled-but-no-shared-tls","traefik-v2","version-before-3.7.11"],"how_to_check":"- Run `traefik version` or check the image tag to see whether the running version is between `v3.7.11` and `v3.7.14`.\n- Check whether `allowCrossNamespaceResources` is set to true in the Traefik configuration; the default is disabled.\n- Look for Ingresses using the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation.","fix":"- Traefik: upgrade to `v3.7.15`.","status":"open","published_at":"2026-10-16T08:01:00+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","triaged_at":"2026-11-09T22:58:28+00:00","updated_at":"2026-11-09T22:58:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:58:28Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik: upgrade to `v3.7.15`.","reach":"network","title":"Traefik: cached TLS option skips namespace check, reuses another namespace's CA secret","impact":"low","summary":"With the default settings, Traefik's Kubernetes Ingress NGINX provider checks cross-namespace access only when it first builds a client-auth TLS option, so a later Ingress can reuse a CA secret from another namespace without the check. An attacker who can create Ingresses in one namespace can enforce another namespace's CA secret on their routes and learn whether that secret exists; the secret contents are not disclosed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traefik","kubernetes","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker learns a secret exists and enforces another namespace's CA","analyst_note":"","how_to_check":"- Run `traefik version` or check the image tag to see whether the running version is between `v3.7.11` and `v3.7.14`.\n- Check whether `allowCrossNamespaceResources` is set to true in the Traefik configuration; the default is disabled.\n- Look for Ingresses using the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-before-3.7.11","default-config-allowCrossNamespaceResources-disabled-but-no-shared-tls","traefik-v2"],"who_is_affected":"Clusters running Traefik v3.7.11 through v3.7.14 with the Kubernetes Ingress NGINX provider enabled, where users can create Ingresses in some namespaces. Traefik v3.7.10 and earlier and Traefik v2 are not affected. Exposure is limited to users who can create Ingresses and only in the sense of learning a secret's existence and using its CA for their own routes.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000859,"input_tokens":4969,"output_tokens":724,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-863':41B '/auth-tls-secret':148C '/traefik/traefik/issues).':291C '/traefik/traefik/releases/tag/v3.7.15':271C '/traefik/traefik/v3':39A '28hp':29A,34A '8vqj':31A,36A 'access':62B 'across':245C 'advisori':284C 'affect':251C,257C 'allow':183C 'allowcrossnamespaceresourc':135C 'alreadi':168C 'annot':149C 'anoth':22A,84B,100B,171C,197C 'attack':90B 'auth':71B 'authent':155C,239C 'author':16A,204C 'build':67B 'built':160C 'bypass':209C 'c82p':30A,35A 'ca':25A,81B,103B,166C,194C 'cach':9A 'certif':203C 'check':17A,58B,88B,143C,180C 'client':70B,154C,202C,238C 'client-auth':69B 'comment':281C 'configur':211C 'content':116B,227C 'creat':93B,185C 'cross':14A,60B,141C 'cross-namespac':13A,59B,140C 'cwe':40B 'default':50B,138C 'disabl':136C 'disclos':119B,230C 'earlier':247C 'enforc':99B,199C 'exist':113B,219C 'first':66B,159C 'ghsa':28A,33A 'ghsa-28hp-c82p-8vqj':27A,32A 'github.com':38A,270C,290C 'github.com/traefik/traefik/issues).':289C 'github.com/traefik/traefik/releases/tag/v3.7.15':269C 'github.com/traefik/traefik/v3':37A 'hit':10A 'host':46B 'includ':262C 'inform':274C 'ingress':2A,20A,55B,77B,94B,131C,163C,172C,186C,246C,265C 'introduc':234C 'isol':213C 'issu':232C,288C 'kubernet':1A,42B,54B,130C,264C 'later':76B,162C 'learn':109B,215C 'let':18A 'low':124C 'namespac':15A,23A,61B,85B,97B,101B,142C,189C,198C,212C 'nginx':3A,56B,132C,266C 'nginx.ingress.kubernetes.io':147C 'nginx.ingress.kubernetes.io/auth-tls-secret':146C 'one':96B,188C 'open':286C 'option':8A,73B,157C,177C,241C 'packag':43B 'patch':268C 'pleas':285C 'provid':4A,57B,133C,267C 'question':279C 'referenc':164C 'reus':79B,173C 'rout':107B,208C 'run':151C 'secret':26A,82B,104B,112B,115B,167C,195C,218C,225C 'self':45B 'self-host':44B 'set':51B 'sever':125C 'share':175C,244C 'sinc':258C 'skip':11A 'start':242C 'summari':120C 'therefor':191C 'tls':7A,72B,156C,176C,240C 'tls-option':6A 'traefik':47B,52B,128C,253C 'use':21A,169C,223C 'user':182C 'v2':254C 'v3.7.11':236C 'version':248C 'vulner':126C 'whether':110B,216C 'without':86B,178C","nicknames":[],"mitigations":[],"who_affected":"Clusters running Traefik v3.7.11 through v3.7.14 with the Kubernetes Ingress NGINX provider enabled, where users can create Ingresses in some namespaces. Traefik v3.7.10 and earlier and Traefik v2 are not affected. Exposure is limited to users who can create Ingresses and only in the sense of learning a secret's existence and using its CA for their own routes.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v3"],"labels":["cwe863","go","kubernetes","low","package","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v3':39A '28hp':29A,34A '8vqj':31A,36A 'anoth':22A 'author':16A 'c82p':30A,35A 'ca':25A 'cach':9A 'check':17A 'cross':14A 'cross-namespac':13A 'ghsa':28A,33A 'ghsa-28hp-c82p-8vqj':27A,32A 'github.com':38A 'github.com/traefik/traefik/v3':37A 'hit':10A 'ingress':2A,20A 'kubernet':1A 'let':18A 'namespac':15A,23A 'nginx':3A 'option':8A 'provid':4A 'secret':26A 'skip':11A 'tls':7A 'tls-option':6A 'use':21A","search_b":"'-863':41B 'access':62B 'anoth':84B,100B 'attack':90B 'auth':71B 'build':67B 'ca':81B,103B 'check':58B,88B 'client':70B 'client-auth':69B 'content':116B 'creat':93B 'cross':60B 'cross-namespac':59B 'cwe':40B 'default':50B 'disclos':119B 'enforc':99B 'exist':113B 'first':66B 'host':46B 'ingress':55B,77B,94B 'kubernet':42B,54B 'later':76B 'learn':109B 'namespac':61B,85B,97B,101B 'nginx':56B 'one':96B 'option':73B 'packag':43B 'provid':57B 'reus':79B 'rout':107B 'secret':82B,104B,112B,115B 'self':45B 'self-host':44B 'set':51B 'tls':72B 'traefik':47B,52B 'whether':110B 'without':86B","search_c":"'/auth-tls-secret':148C '/traefik/traefik/issues).':291C '/traefik/traefik/releases/tag/v3.7.15':271C 'across':245C 'advisori':284C 'affect':251C,257C 'allow':183C 'allowcrossnamespaceresourc':135C 'alreadi':168C 'annot':149C 'anoth':171C,197C 'authent':155C,239C 'author':204C 'built':160C 'bypass':209C 'ca':166C,194C 'certif':203C 'check':143C,180C 'client':154C,202C,238C 'comment':281C 'configur':211C 'content':227C 'creat':185C 'cross':141C 'cross-namespac':140C 'default':138C 'disabl':136C 'disclos':230C 'earlier':247C 'enforc':199C 'exist':219C 'first':159C 'github.com':270C,290C 'github.com/traefik/traefik/issues).':289C 'github.com/traefik/traefik/releases/tag/v3.7.15':269C 'includ':262C 'inform':274C 'ingress':131C,163C,172C,186C,246C,265C 'introduc':234C 'isol':213C 'issu':232C,288C 'kubernet':130C,264C 'later':162C 'learn':215C 'low':124C 'namespac':142C,189C,198C,212C 'nginx':132C,266C 'nginx.ingress.kubernetes.io':147C 'nginx.ingress.kubernetes.io/auth-tls-secret':146C 'one':188C 'open':286C 'option':157C,177C,241C 'patch':268C 'pleas':285C 'provid':133C,267C 'question':279C 'referenc':164C 'reus':173C 'rout':208C 'run':151C 'secret':167C,195C,218C,225C 'sever':125C 'share':175C,244C 'sinc':258C 'start':242C 'summari':120C 'therefor':191C 'tls':156C,176C,240C 'traefik':128C,253C 'use':169C,223C 'user':182C 'v2':254C 'v3.7.11':236C 'version':248C 'vulner':126C 'whether':216C 'without':178C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T08:01:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-28hp-c82p-8vqj","url":"https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj","severity":"low","published_at":"2026-10-16T08:01:00+00:00","modified_at":"2026-10-16T08:01:00+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","fetched_at":"2026-11-09T22:53:32+00:00","note":null}],"documents":[{"id":49641,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T08:01:00+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}