---
id: "GHSA-28hp-c82p-8vqj"
page: "https://infrastack.ai/live/GHSA-28hp-c82p-8vqj"
kind: "vulnerability"
aliases: ["GHSA-28hp-c82p-8vqj"]
title: "Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret"
severity: "low"
cvss: 2.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.15"], "affected": ">= v3.7.11, <= v3.7.14", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-863", "kubernetes", "package", "self-hosted", "traefik"]
not_affected_if: ["default-config-allowcrossnamespaceresources-disabled-but-no-shared-tls", "traefik-v2", "version-before-3.7.11"]
published_at: "2026-10-16T08:01:00+00:00"
first_seen_at: "2026-11-09T22:53:32+00:00"
updated_at: "2026-11-09T22:58:28+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj", "first_seen_at": "2026-11-09T22:53:32+00:00"}]
exploit_sources: []
---

# Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret

Link for people: https://infrastack.ai/live/GHSA-28hp-c82p-8vqj (this .md is for agents)

With the default settings, Traefik's Kubernetes Ingress NGINX provider checks cross-namespace access only when it first builds a client-auth TLS option, so a later Ingress can reuse a CA secret from another namespace without the check. An attacker who can create Ingresses in one namespace can enforce another namespace's CA secret on their routes and learn whether that secret exists; the secret contents are not disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.7.11, <= v3.7.14 fixed v3.7.15

## How to check

- Run `traefik version` or check the image tag to see whether the running version is between `v3.7.11` and `v3.7.14`.
- Check whether `allowCrossNamespaceResources` is set to true in the Traefik configuration; the default is disabled.
- Look for Ingresses using the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation.

## Fix

- Traefik: upgrade to `v3.7.15`.

## Timeline

- 2026-11-09T22:53:32+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj

## From the sources

## Summary

There is a low severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. With `allowCrossNamespaceResources` disabled (the default), the cross-namespace check on the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation only runs when a client authentication TLS option is first built: a later Ingress referencing a CA secret already used by another Ingress reuses the shared TLS option without being checked. A user allowed to create Ingresses in one namespace can therefore have a CA secret from another namespace enforced as the client certificate authority of their own routes, bypassing the configured namespace isolation, and learn whether that secret exists and is in use; the secret's contents are not disclosed. The issue was introduced in v3.7.11, when client authentication TLS options started being shared across Ingresses; earlier versions are not affected, and Traefik v2 is not affected since it does not include the Kubernetes Ingress NGINX provider.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.15

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_