GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-ccgh-9g52-6vwg · Infrastructure
FIX → v3.8.0-rc.2 +1
In Traefik's Kubernetes Ingress NGINX provider, when several Ingresses share a host with client certificate authentication, the Ssl-Client-* headers can be built from an Ingress that never verified the certificate. An unauthenticated remote client can present a forged client identity to a backend that trusts the proxy's verification result.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Exposure requires the Kubernetes Ingress NGINX provider with client certificate authentication (auth-tls-secret) on hosts shared by several Ingresses. Backends that trust the Ssl-Client-* headers for identity are the ones at risk. Deployments on earlier versions, Traefik v2, or without this annotation are not affected.
Not affected if default-config, no-auth-tls-secret, traefik-v2, versions-before-3.7.15
Who cares ingress-nginx, kubernetes, mtls, traefik
traefik version; affected builds are v3.7.15 through v3.7.17 (Go) and v3.8.0-rc.1 (container/composer tag)nginx.ingress.kubernetes.io/auth-tls-secret annotation, especially several on one hostThere is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider when several Ingresses share a host configured for client certificate authentication with the nginx.ingress.kubernetes.io/auth-tls-secret annotation. Since v3.7.15 the client authentication applies to the whole host and the TLS handshake uses the settings of the first Ingress declaring it, but the Ssl-Client-* headers were still built from the annotations of each Ingress: an Ingress with auth-tls-verify-client: on sharing a host with an Ingress using optional_no_ca forwarded Ssl-Client-Verify: SUCCESS, together with the subject and issuer chosen by the client, for a certificate that was never verified, and an Ingress without its own auth-tls-secret or without auth-tls-pass-certificate-to-upstream had no middleware handling these headers, so the values sent by the client reached the backend. An unauthenticated remote client can therefore present a forged client identity to a backend that trusts the proxy's verification result.
The issue was introduced in v3.7.15; earlier versions are not affected, and Traefik v2 is not affected since it does not include the Kubernetes Ingress NGINX provider.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
auth-tls-verify-client: onoptional_no_caSsl-Client-*Upgrade to v3.8.0-rc.2 +1
github.com/traefik/traefik/v3): move to v3.7.18 or laterv3.8.0-rc.1 prerelease: move to v3.8.0-rc.2If you have any questions or comments about this advisory, please open an issue.