---
id: "GHSA-mwrr-6hp4-pxr6"
page: "https://infrastack.ai/live/GHSA-mwrr-6hp4-pxr6"
kind: "vulnerability"
aliases: ["GHSA-mwrr-6hp4-pxr6"]
title: "Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.14"], "affected": ">= v3.7.0, <= v3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ingress-nginx", "kubernetes", "mtls", "package", "traefik"]
not_affected_if: ["default-config", "no-auth-tls-annotation", "pre-v3.7.0"]
published_at: "2026-10-07T08:47:36+00:00"
first_seen_at: "2026-11-09T22:53:33+00:00"
updated_at: "2026-11-09T23:00:27+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6", "first_seen_at": "2026-11-09T22:53:33+00:00"}]
exploit_sources: []
---

# Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route

Link for people: https://infrastack.ai/live/GHSA-mwrr-6hp4-pxr6 (this .md is for agents)

For Ingress rules using the auth-tls-pass-certificate-to-upstream annotation, Traefik's plaintext HTTP route forwards Ssl-Client-* headers that the client sent. When ssl-redirect is set to false, an unauthenticated client can send Ssl-Client-Verify: SUCCESS with a chosen subject and issuer, and a backend that trusts those headers as mTLS identity will authorize the request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.7.0, <= v3.7.13 fixed v3.7.14

## How to check

- Check the Traefik version with `traefik version`; affected builds are `v3.7.0` through `v3.7.13`.
- Search Ingress manifests for `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` and `nginx.ingress.kubernetes.io/ssl-redirect: "false"`.
- Check whether backends trust Ssl-Client-* headers as client identity.

## Fix

- Traefik: `v3.7.14`

## Timeline

- 2026-11-09T22:53:33+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6

## From the sources

## Summary

There is a high severity vulnerability in Traefik's Kubernetes Ingress-NGINX provider. For an Ingress carrying the `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` annotation, the middleware that owns the `Ssl-Client-*` request headers is attached only to the TLS router, so the plaintext HTTP router generated for the same Ingress forwards those headers exactly as the client sent them. That router normally only issues a redirect, but when `nginx.ingress.kubernetes.io/ssl-redirect: "false"` is set it reaches the backend, and an unauthenticated client can then supply `Ssl-Client-Verify: SUCCESS` together with a chosen certificate subject and issuer. A backend that trusts those proxy-generated fields as an mTLS identity authorizes the request even though no client certificate was presented.

Only the Traefik v3.7 line is affected: support for the `auth-tls-pass-certificate-to-upstream` annotation was added in v3.7.0, and earlier versions do not translate it.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.14

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_