---
id: "GHSA-ccgh-9g52-6vwg"
page: "https://infrastack.ai/live/GHSA-ccgh-9g52-6vwg"
kind: "vulnerability"
aliases: ["GHSA-ccgh-9g52-6vwg"]
title: "ingress-nginx client certificate authentication (auth-tls-secret) verification bypass and Ssl-Client-* header spoofing on shared hosts"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.18"], "affected": ">= v3.7.15, <= v3.7.17", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.8.0-rc.2"], "affected": ">= v3.8.0-rc.1, <= v3.8.0-rc.1", "ecosystem": "composer"}]
ecosystems: ["composer", "go"]
tags: ["cwe-290", "cwe-295", "infrastructure", "ingress-nginx", "kubernetes", "mtls", "traefik"]
not_affected_if: ["default-config", "no-auth-tls-secret", "traefik-v2", "versions-before-3.7.15"]
published_at: "2026-11-12T10:01:22+00:00"
first_seen_at: "2026-11-12T10:09:07+00:00"
updated_at: "2026-11-12T10:10:17+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-ccgh-9g52-6vwg", "first_seen_at": "2026-11-12T10:09:07+00:00"}]
exploit_sources: []
---

# ingress-nginx client certificate authentication (auth-tls-secret) verification bypass and Ssl-Client-* header spoofing on shared hosts

Link for people: https://infrastack.ai/live/GHSA-ccgh-9g52-6vwg (this .md is for agents)

In Traefik's Kubernetes Ingress NGINX provider, when several Ingresses share a host with client certificate authentication, the Ssl-Client-* headers can be built from an Ingress that never verified the certificate. An unauthenticated remote client can present a forged client identity to a backend that trusts the proxy's verification result.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.7.15, <= v3.7.17 fixed v3.7.18
- composer:github.com/traefik/traefik/v3 affected >= v3.8.0-rc.1, <= v3.8.0-rc.1 fixed v3.8.0-rc.2

## How to check

- Check the Traefik version with `traefik version`; affected builds are `v3.7.15` through `v3.7.17` (Go) and `v3.8.0-rc.1` (container/composer tag)
- Look for Ingresses using the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation, especially several on one host
- Check whether any Ingress on those hosts sets `auth-tls-verify-client: on` or `optional_no_ca`, and whether backends trust `Ssl-Client-*` headers

## Fix

- Traefik (Go module `github.com/traefik/traefik/v3`): move to `v3.7.18` or later
- Traefik `v3.8.0-rc.1` prerelease: move to `v3.8.0-rc.2`

## Timeline

- 2026-11-12T10:09:07+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-ccgh-9g52-6vwg

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-ccgh-9g52-6vwg

## From the sources

## Summary

There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider when several Ingresses share a host configured for client certificate authentication with the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation. Since v3.7.15 the client authentication applies to the whole host and the TLS handshake uses the settings of the first Ingress declaring it, but the `Ssl-Client-*` headers were still built from the annotations of each Ingress: an Ingress with `auth-tls-verify-client: on` sharing a host with an Ingress using `optional_no_ca` forwarded `Ssl-Client-Verify: SUCCESS`, together with the subject and issuer chosen by the client, for a certificate that was never verified, and an Ingress without its own `auth-tls-secret` or without `auth-tls-pass-certificate-to-upstream` had no middleware handling these headers, so the values sent by the client reached the backend. An unauthenticated remote client can therefore present a forged client identity to a backend that trusts the proxy's verification result. 

The issue was introduced in v3.7.15; earlier versions are not affected, and Traefik v2 is not affected since it does not include the Kubernetes Ingress NGINX provider.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.18
- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_