{"id":"GHSA-mwrr-6hp4-pxr6","kind":"vulnerability","aliases":["GHSA-mwrr-6hp4-pxr6"],"related":[],"title":"Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Ingress-NGINX provider. For an Ingress carrying the `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` annotation, the middleware that owns the `Ssl-Client-*` request headers is attached only to the TLS router, so the plaintext HTTP router generated for the same Ingress forwards those headers exactly as the client sent them. That router normally only issues a redirect, but when `nginx.ingress.kubernetes.io/ssl-redirect: \"false\"` is set it reaches the backend, and an unauthenticated client can then supply `Ssl-Client-Verify: SUCCESS` together with a chosen certificate subject and issuer. A backend that trusts those proxy-generated fields as an mTLS identity authorizes the request even though no client certificate was presented.\n\nOnly the Traefik v3.7 line is affected: support for the `auth-tls-pass-certificate-to-upstream` annotation was added in v3.7.0, and earlier versions do not translate it.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"For Ingress rules using the auth-tls-pass-certificate-to-upstream annotation, Traefik's plaintext HTTP route forwards Ssl-Client-* headers that the client sent. When ssl-redirect is set to false, an unauthenticated client can send Ssl-Client-Verify: SUCCESS with a chosen subject and issuer, and a backend that trusts those headers as mTLS identity will authorize the request.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.14"],"affected":">= v3.7.0, <= v3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["ingress-nginx","kubernetes","mtls","package","traefik"],"not_affected_if":["default-config","no-auth-tls-annotation","pre-v3.7.0"],"how_to_check":"- Check the Traefik version with `traefik version`; affected builds are `v3.7.0` through `v3.7.13`.\n- Search Ingress manifests for `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` and `nginx.ingress.kubernetes.io/ssl-redirect: \"false\"`.\n- Check whether backends trust Ssl-Client-* headers as client identity.","fix":"- Traefik: `v3.7.14`","status":"open","published_at":"2026-10-07T08:47:36+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","triaged_at":"2026-11-09T23:00:27+00:00","updated_at":"2026-11-09T23:00:27+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T23:00:27Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik: `v3.7.14`","reach":"internet","title":"Traefik: Ingress-NGINX provider lets forged client-certificate headers reach backends","impact":"high","summary":"For Ingress rules using the auth-tls-pass-certificate-to-upstream annotation, Traefik's plaintext HTTP route forwards Ssl-Client-* headers that the client sent. When ssl-redirect is set to false, an unauthenticated client can send Ssl-Client-Verify: SUCCESS with a chosen subject and issuer, and a backend that trusts those headers as mTLS identity will authorize the request.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traefik","kubernetes","ingress-nginx","mtls"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated clients impersonate certificate identities at backends that trust headers","analyst_note":"product_name","how_to_check":"- Check the Traefik version with `traefik version`; affected builds are `v3.7.0` through `v3.7.13`.\n- Search Ingress manifests for `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` and `nginx.ingress.kubernetes.io/ssl-redirect: \"false\"`.\n- Check whether backends trust Ssl-Client-* headers as client identity.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","pre-v3.7.0","no-auth-tls-annotation"],"who_is_affected":"Only Kubernetes clusters running the Traefik v3.7 line with the Ingress-NGINX provider and the auth-tls-pass-certificate-to-upstream annotation are exposed. The risk needs ssl-redirect set to false so the plaintext route reaches the backend, and a backend that treats proxy-set client certificate headers as identity. Clusters on earlier Traefik versions, or not using this annotation, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000867,"input_tokens":4992,"output_tokens":736,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'/auth-tls-pass-certificate-to-upstream':123C '/ssl-redirect:':172C '/traefik/traefik/issues).':275C '/traefik/traefik/releases/tag/v3.7.14':255C '/traefik/traefik/v3':28A '6hp4':19A,24A 'add':242C 'advisori':268C 'affect':229C 'annot':48B,124C,240C 'attach':136C 'auth':42B,234C 'auth-tls-pass-certificate-to-upstream':41B,233C 'author':98B,213C 'backend':89B,179C,201C 'carri':119C 'certif':45B,196C,220C,237C 'chosen':83B,195C 'client':9A,57B,61B,73B,78B,132C,158C,183C,189C,219C 'comment':265C 'earlier':246C 'even':216C 'exact':155C 'fals':70B,173C 'field':208C 'forg':6A 'forward':5A,54B,152C 'generat':147C,207C 'ghsa':17A,22A 'ghsa-mwrr-6hp4-pxr6':16A,21A 'github.com':27A,254C,274C 'github.com/traefik/traefik/issues).':273C 'github.com/traefik/traefik/releases/tag/v3.7.14':253C 'github.com/traefik/traefik/v3':26A 'header':11A,58B,93B,134C,154C 'high':105C 'http':14A,52B,145C 'ident':10A,96B,212C 'inform':258C 'ingress':2A,30B,37B,113C,118C,151C 'ingress-nginx':1A,29B,112C 'issu':165C,272C 'issuer':86B,199C 'kubernet':32B,111C 'line':227C 'middlewar':126C 'mtls':33B,95B,211C 'mwrr':18A,23A 'nginx':3A,31B,114C 'nginx.ingress.kubernetes.io':122C,171C 'nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream':121C 'nginx.ingress.kubernetes.io/ssl-redirect:':170C 'normal':163C 'open':270C 'own':128C 'packag':34B 'pass':44B,236C 'patch':252C 'plaintext':51B,144C 'pleas':269C 'present':222C 'provid':4A,115C 'proxi':206C 'proxy-gener':205C 'pxr6':20A,25A 'question':263C 'reach':177C 'redirect':66B,167C 'request':100B,133C,215C 'rout':15A,53B 'router':141C,146C,162C 'rule':38B 'send':75B 'sent':62B,159C 'set':68B,175C 'sever':106C 'ssl':8A,56B,65B,77B,131C,188C 'ssl-client':7A,55B,130C 'ssl-client-verifi':76B,187C 'ssl-redirect':64B 'subject':84B,197C 'success':80B,191C 'summari':101C 'suppli':186C 'support':230C 'though':217C 'tls':43B,140C,235C 'togeth':192C 'traefik':35B,49B,109C,225C 'translat':250C 'trust':91B,203C 'unauthent':72B,182C 'upstream':47B,239C 'use':39B 'v3.7':226C 'v3.7.0':244C 'verifi':79B,190C 'version':247C 'vulner':107C","nicknames":[],"mitigations":[],"who_affected":"Only Kubernetes clusters running the Traefik v3.7 line with the Ingress-NGINX provider and the auth-tls-pass-certificate-to-upstream annotation are exposed. The risk needs ssl-redirect set to false so the plaintext route reaches the backend, and a backend that treats proxy-set client certificate headers as identity. Clusters on earlier Traefik versions, or not using this annotation, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v3"],"labels":["go","high","ingressnginx","kubernetes","mtls","package","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v3':28A '6hp4':19A,24A 'client':9A 'forg':6A 'forward':5A 'ghsa':17A,22A 'ghsa-mwrr-6hp4-pxr6':16A,21A 'github.com':27A 'github.com/traefik/traefik/v3':26A 'header':11A 'http':14A 'ident':10A 'ingress':2A 'ingress-nginx':1A 'mwrr':18A,23A 'nginx':3A 'provid':4A 'pxr6':20A,25A 'rout':15A 'ssl':8A 'ssl-client':7A","search_b":"'annot':48B 'auth':42B 'auth-tls-pass-certificate-to-upstream':41B 'author':98B 'backend':89B 'certif':45B 'chosen':83B 'client':57B,61B,73B,78B 'fals':70B 'forward':54B 'header':58B,93B 'http':52B 'ident':96B 'ingress':30B,37B 'ingress-nginx':29B 'issuer':86B 'kubernet':32B 'mtls':33B,95B 'nginx':31B 'packag':34B 'pass':44B 'plaintext':51B 'redirect':66B 'request':100B 'rout':53B 'rule':38B 'send':75B 'sent':62B 'set':68B 'ssl':56B,65B,77B 'ssl-client':55B 'ssl-client-verifi':76B 'ssl-redirect':64B 'subject':84B 'success':80B 'tls':43B 'traefik':35B,49B 'trust':91B 'unauthent':72B 'upstream':47B 'use':39B 'verifi':79B","search_c":"'/auth-tls-pass-certificate-to-upstream':123C '/ssl-redirect:':172C '/traefik/traefik/issues).':275C '/traefik/traefik/releases/tag/v3.7.14':255C 'add':242C 'advisori':268C 'affect':229C 'annot':124C,240C 'attach':136C 'auth':234C 'auth-tls-pass-certificate-to-upstream':233C 'author':213C 'backend':179C,201C 'carri':119C 'certif':196C,220C,237C 'chosen':195C 'client':132C,158C,183C,189C,219C 'comment':265C 'earlier':246C 'even':216C 'exact':155C 'fals':173C 'field':208C 'forward':152C 'generat':147C,207C 'github.com':254C,274C 'github.com/traefik/traefik/issues).':273C 'github.com/traefik/traefik/releases/tag/v3.7.14':253C 'header':134C,154C 'high':105C 'http':145C 'ident':212C 'inform':258C 'ingress':113C,118C,151C 'ingress-nginx':112C 'issu':165C,272C 'issuer':199C 'kubernet':111C 'line':227C 'middlewar':126C 'mtls':211C 'nginx':114C 'nginx.ingress.kubernetes.io':122C,171C 'nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream':121C 'nginx.ingress.kubernetes.io/ssl-redirect:':170C 'normal':163C 'open':270C 'own':128C 'pass':236C 'patch':252C 'plaintext':144C 'pleas':269C 'present':222C 'provid':115C 'proxi':206C 'proxy-gener':205C 'question':263C 'reach':177C 'redirect':167C 'request':133C,215C 'router':141C,146C,162C 'sent':159C 'set':175C 'sever':106C 'ssl':131C,188C 'ssl-client':130C 'ssl-client-verifi':187C 'subject':197C 'success':191C 'summari':101C 'suppli':186C 'support':230C 'though':217C 'tls':140C,235C 'togeth':192C 'traefik':109C,225C 'translat':250C 'trust':203C 'unauthent':182C 'upstream':239C 'v3.7':226C 'v3.7.0':244C 'verifi':190C 'version':247C 'vulner':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-mwrr-6hp4-pxr6","url":"https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6","severity":"high","published_at":"2026-10-07T08:47:36+00:00","modified_at":"2026-10-07T08:47:36+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","fetched_at":"2026-11-09T22:53:33+00:00","note":null}],"documents":[{"id":46271,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:36+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}