{"id":"GHSA-ccgh-9g52-6vwg","kind":"vulnerability","aliases":["GHSA-ccgh-9g52-6vwg"],"related":[],"title":"ingress-nginx client certificate authentication (auth-tls-secret) verification bypass and Ssl-Client-* header spoofing on shared hosts","description":"## Summary\r\n\r\nThere is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider when several Ingresses share a host configured for client certificate authentication with the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation. Since v3.7.15 the client authentication applies to the whole host and the TLS handshake uses the settings of the first Ingress declaring it, but the `Ssl-Client-*` headers were still built from the annotations of each Ingress: an Ingress with `auth-tls-verify-client: on` sharing a host with an Ingress using `optional_no_ca` forwarded `Ssl-Client-Verify: SUCCESS`, together with the subject and issuer chosen by the client, for a certificate that was never verified, and an Ingress without its own `auth-tls-secret` or without `auth-tls-pass-certificate-to-upstream` had no middleware handling these headers, so the values sent by the client reached the backend. An unauthenticated remote client can therefore present a forged client identity to a backend that trusts the proxy's verification result. \r\n\r\nThe issue was introduced in v3.7.15; earlier versions are not affected, and Traefik v2 is not affected since it does not include the Kubernetes Ingress NGINX provider.\r\n\r\n## Patches\r\n\r\n- https://github.com/traefik/traefik/releases/tag/v3.7.18\r\n- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2\r\n\r\n## For more information\r\n\r\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"In Traefik's Kubernetes Ingress NGINX provider, when several Ingresses share a host with client certificate authentication, the Ssl-Client-* headers can be built from an Ingress that never verified the certificate. An unauthenticated remote client can present a forged client identity to a backend that trusts the proxy's verification result.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.18"],"affected":">= v3.7.15, <= v3.7.17","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.8.0-rc.2"],"affected":">= v3.8.0-rc.1, <= v3.8.0-rc.1","ecosystem":"composer"}],"ecosystems":["composer","go"],"tags":["cwe-290","cwe-295","infrastructure","ingress-nginx","kubernetes","mtls","traefik"],"not_affected_if":["default-config","no-auth-tls-secret","traefik-v2","versions-before-3.7.15"],"how_to_check":"- Check the Traefik version with `traefik version`; affected builds are `v3.7.15` through `v3.7.17` (Go) and `v3.8.0-rc.1` (container/composer tag)\n- Look for Ingresses using the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation, especially several on one host\n- Check whether any Ingress on those hosts sets `auth-tls-verify-client: on` or `optional_no_ca`, and whether backends trust `Ssl-Client-*` headers","fix":"- Traefik (Go module `github.com/traefik/traefik/v3`): move to `v3.7.18` or later\n- Traefik `v3.8.0-rc.1` prerelease: move to `v3.8.0-rc.2`","status":"open","published_at":"2026-11-12T10:01:22+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","triaged_at":"2026-11-12T10:10:17+00:00","updated_at":"2026-11-12T10:10:17+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T10:10:17Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik (Go module `github.com/traefik/traefik/v3`): move to `v3.7.18` or later\n- Traefik `v3.8.0-rc.1` prerelease: move to `v3.8.0-rc.2`","reach":"internet","title":"Traefik: shared-host client certificate checks can be bypassed with forged identity headers","impact":"medium","summary":"In Traefik's Kubernetes Ingress NGINX provider, when several Ingresses share a host with client certificate authentication, the Ssl-Client-* headers can be built from an Ingress that never verified the certificate. An unauthenticated remote client can present a forged client identity to a backend that trusts the proxy's verification result.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["traefik","kubernetes","ingress-nginx","mtls"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Backend accepts a forged client identity from an unauthenticated remote client","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version`; affected builds are `v3.7.15` through `v3.7.17` (Go) and `v3.8.0-rc.1` (container/composer tag)\n- Look for Ingresses using the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation, especially several on one host\n- Check whether any Ingress on those hosts sets `auth-tls-verify-client: on` or `optional_no_ca`, and whether backends trust `Ssl-Client-*` headers","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-auth-tls-secret","traefik-v2","versions-before-3.7.15"],"who_is_affected":"Exposure requires the Kubernetes Ingress NGINX provider with client certificate authentication (auth-tls-secret) on hosts shared by several Ingresses. Backends that trust the Ssl-Client-* headers for identity are the ones at risk. Deployments on earlier versions, Traefik v2, or without this annotation are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000901,"input_tokens":5168,"output_tokens":768,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-290':39B '-295':41B '/auth-tls-secret':131C '/traefik/traefik/issues).':322C '/traefik/traefik/releases/tag/v3.7.18':299C '/traefik/traefik/releases/tag/v3.8.0-rc.2':302C '/traefik/traefik/v3':34A,37A '6vwg':26A,31A '9g52':25A,30A 'advisori':315C 'affect':279C,285C 'annot':132C,167C 'appli':138C 'auth':8A,175C,220C,226C 'auth-tls-pass-certificate-to-upstream':225C 'auth-tls-secret':7A,219C 'auth-tls-verify-cli':174C 'authent':6A,65B,126C,137C 'backend':94B,247C,261C 'built':73B,164C 'bypass':12A 'ca':189C 'ccgh':24A,29A 'certif':5A,64B,81B,125C,208C,229C 'chosen':202C 'client':4A,16A,63B,69B,85B,90B,124C,136C,160C,178C,193C,205C,244C,251C,257C 'comment':312C 'configur':122C 'cwe':38B,40B 'declar':154C 'earlier':275C 'first':152C 'forg':89B,256C 'forward':190C 'ghsa':23A,28A 'ghsa-ccgh-9g52-6vwg':22A,27A 'github.com':33A,36A,298C,301C,321C 'github.com/traefik/traefik/issues).':320C 'github.com/traefik/traefik/releases/tag/v3.7.18':297C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':300C 'github.com/traefik/traefik/v3':32A,35A 'handl':235C 'handshak':146C 'header':17A,70B,161C,237C 'high':106C 'host':21A,61B,121C,142C,182C 'ident':91B,258C 'includ':290C 'inform':305C 'infrastructur':42B 'ingress':2A,44B,53B,58B,76B,113C,118C,153C,170C,172C,185C,215C,293C 'ingress-nginx':1A,43B 'introduc':272C 'issu':270C,319C 'issuer':201C 'kubernet':46B,52B,112C,292C 'middlewar':234C 'mtls':47B 'never':78B,211C 'nginx':3A,45B,54B,114C,294C 'nginx.ingress.kubernetes.io':130C 'nginx.ingress.kubernetes.io/auth-tls-secret':129C 'open':317C 'option':187C 'pass':228C 'patch':296C 'pleas':316C 'present':87B,254C 'provid':55B,115C,295C 'proxi':98B,265C 'question':310C 'reach':245C 'remot':84B,250C 'result':101B,268C 'secret':10A,222C 'sent':241C 'set':149C 'sever':57B,107C,117C 'share':20A,59B,119C,180C 'sinc':133C,286C 'spoof':18A 'ssl':15A,68B,159C,192C 'ssl-client':14A,67B,158C 'ssl-client-verifi':191C 'still':163C 'subject':199C 'success':195C 'summari':102C 'therefor':253C 'tls':9A,145C,176C,221C,227C 'togeth':196C 'traefik':48B,50B,110C,281C 'trust':96B,263C 'unauthent':83B,249C 'upstream':231C 'use':147C,186C 'v2':282C 'v3.7.15':134C,274C 'valu':240C 'verif':11A,100B,267C 'verifi':79B,177C,194C,212C 'version':276C 'vulner':108C 'whole':141C 'without':216C,224C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires the Kubernetes Ingress NGINX provider with client certificate authentication (auth-tls-secret) on hosts shared by several Ingresses. Backends that trust the Ssl-Client-* headers for identity are the ones at risk. Deployments on earlier versions, Traefik v2, or without this annotation are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v3"],"labels":["composer","cwe290","cwe295","go","high","infrastructure","ingressnginx","kubernetes","mtls","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v3':34A,37A '6vwg':26A,31A '9g52':25A,30A 'auth':8A 'auth-tls-secret':7A 'authent':6A 'bypass':12A 'ccgh':24A,29A 'certif':5A 'client':4A,16A 'ghsa':23A,28A 'ghsa-ccgh-9g52-6vwg':22A,27A 'github.com':33A,36A 'github.com/traefik/traefik/v3':32A,35A 'header':17A 'host':21A 'ingress':2A 'ingress-nginx':1A 'nginx':3A 'secret':10A 'share':20A 'spoof':18A 'ssl':15A 'ssl-client':14A 'tls':9A 'verif':11A","search_b":"'-290':39B '-295':41B 'authent':65B 'backend':94B 'built':73B 'certif':64B,81B 'client':63B,69B,85B,90B 'cwe':38B,40B 'forg':89B 'header':70B 'host':61B 'ident':91B 'infrastructur':42B 'ingress':44B,53B,58B,76B 'ingress-nginx':43B 'kubernet':46B,52B 'mtls':47B 'never':78B 'nginx':45B,54B 'present':87B 'provid':55B 'proxi':98B 'remot':84B 'result':101B 'sever':57B 'share':59B 'ssl':68B 'ssl-client':67B 'traefik':48B,50B 'trust':96B 'unauthent':83B 'verif':100B 'verifi':79B","search_c":"'/auth-tls-secret':131C '/traefik/traefik/issues).':322C '/traefik/traefik/releases/tag/v3.7.18':299C '/traefik/traefik/releases/tag/v3.8.0-rc.2':302C 'advisori':315C 'affect':279C,285C 'annot':132C,167C 'appli':138C 'auth':175C,220C,226C 'auth-tls-pass-certificate-to-upstream':225C 'auth-tls-secret':219C 'auth-tls-verify-cli':174C 'authent':126C,137C 'backend':247C,261C 'built':164C 'ca':189C 'certif':125C,208C,229C 'chosen':202C 'client':124C,136C,160C,178C,193C,205C,244C,251C,257C 'comment':312C 'configur':122C 'declar':154C 'earlier':275C 'first':152C 'forg':256C 'forward':190C 'github.com':298C,301C,321C 'github.com/traefik/traefik/issues).':320C 'github.com/traefik/traefik/releases/tag/v3.7.18':297C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':300C 'handl':235C 'handshak':146C 'header':161C,237C 'high':106C 'host':121C,142C,182C 'ident':258C 'includ':290C 'inform':305C 'ingress':113C,118C,153C,170C,172C,185C,215C,293C 'introduc':272C 'issu':270C,319C 'issuer':201C 'kubernet':112C,292C 'middlewar':234C 'never':211C 'nginx':114C,294C 'nginx.ingress.kubernetes.io':130C 'nginx.ingress.kubernetes.io/auth-tls-secret':129C 'open':317C 'option':187C 'pass':228C 'patch':296C 'pleas':316C 'present':254C 'provid':115C,295C 'proxi':265C 'question':310C 'reach':245C 'remot':250C 'result':268C 'secret':222C 'sent':241C 'set':149C 'sever':107C,117C 'share':119C,180C 'sinc':133C,286C 'ssl':159C,192C 'ssl-client':158C 'ssl-client-verifi':191C 'still':163C 'subject':199C 'success':195C 'summari':102C 'therefor':253C 'tls':145C,176C,221C,227C 'togeth':196C 'traefik':110C,281C 'trust':263C 'unauthent':249C 'upstream':231C 'use':147C,186C 'v2':282C 'v3.7.15':134C,274C 'valu':240C 'verif':267C 'verifi':177C,194C,212C 'version':276C 'vulner':108C 'whole':141C 'without':216C,224C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T10:01:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-ccgh-9g52-6vwg","url":"https://github.com/traefik/traefik/security/advisories/GHSA-ccgh-9g52-6vwg","severity":"high","published_at":"2026-11-12T10:01:22+00:00","modified_at":"2026-11-12T10:08:35+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","fetched_at":"2026-11-12T11:40:04+00:00","note":null}],"documents":[{"id":133896,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-ccgh-9g52-6vwg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}