GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-mwrr-6hp4-pxr6 · Package
FIX → v3.7.14
For Ingress rules using the auth-tls-pass-certificate-to-upstream annotation, Traefik's plaintext HTTP route forwards Ssl-Client-* headers that the client sent. When ssl-redirect is set to false, an unauthenticated client can send Ssl-Client-Verify: SUCCESS with a chosen subject and issuer, and a backend that trusts those headers as mTLS identity will authorize the request.
first public Oct 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Kubernetes clusters running the Traefik v3.7 line with the Ingress-NGINX provider and the auth-tls-pass-certificate-to-upstream annotation are exposed. The risk needs ssl-redirect set to false so the plaintext route reaches the backend, and a backend that treats proxy-set client certificate headers as identity. Clusters on earlier Traefik versions, or not using this annotation, are not affected.
Not affected if default-config, no-auth-tls-annotation, pre-v3.7.0
Who cares ingress-nginx, kubernetes, mtls, traefik
traefik version; affected builds are v3.7.0 through v3.7.13.nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream and nginx.ingress.kubernetes.io/ssl-redirect: "false".There is a high severity vulnerability in Traefik's Kubernetes Ingress-NGINX provider. For an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream annotation, the middleware that owns the Ssl-Client-* request headers is attached only to the TLS router, so the plaintext HTTP router generated for the same Ingress forwards those headers exactly as the client sent them. That router normally only issues a redirect, but when nginx.ingress.kubernetes.io/ssl-redirect: "false" is set it reaches the backend, and an unauthenticated client can then supply Ssl-Client-Verify: SUCCESS together with a chosen certificate subject and issuer. A backend that trusts those proxy-generated fields as an mTLS identity authorizes the request even though no client certificate was presented.
Only the Traefik v3.7 line is affected: support for the auth-tls-pass-certificate-to-upstream annotation was added in v3.7.0, and earlier versions do not translate it.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v3.7.14
v3.7.14