GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-p8wx-ph99-xgcr · Infrastructure
FIX → v3.7.15
When Traefik's Kubernetes Ingress NGINX provider serves a host where one Ingress sets auth-tls-secret and another Ingress on the same host does not, the client certificate requirement is dropped for that host. An unauthenticated remote attacker can then reach backends that were meant to require a client certificate.
first public Oct 16, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only teams running Traefik v3.7.0-ea.1 through v3.7.14 as a Kubernetes Ingress NGINX provider that uses auth-tls-secret mTLS. Exposure needs two Ingresses sharing one host, with only one of them carrying the auth-tls settings, and without core.strictTLSOptions enabled. Traefik v2 and versions before v3.7.0 are not affected.
Not affected if default-config-no-auth-tls, pre-v3.7-traefik, single-ingress-per-host, strict-tls-options
Who cares ingress-nginx, kubernetes, mtls, traefik
traefik version; affected builds are >= v3.7.0-ea.1 and <= v3.7.14.kubectl get ingress -A -o yaml and look for hosts where some Ingresses carry nginx.ingress.kubernetes.io/auth-tls-secret and others on the same host do not.core.strictTLSOptions is not enabled, since the advisory says strict mode avoids the fallback.There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider where mutual TLS client authentication configured with the nginx.ingress.kubernetes.io/auth-tls-secret annotation is silently disabled for a host when another Ingress declares a path on that same host without the same auth-tls settings. The provider attaches the client-authentication TLS option per Ingress rather than per host, so the conflicting TLS options on the host make Traefik fall back to the default TLS options, which do not request a client certificate, unless core.strictTLSOptions is enabled. An unauthenticated remote attacker can then reach the backends that were meant to require a client certificate. Traefik v2 and Traefik v3 versions before v3.7.0 are not affected: support for the auth-tls-secret annotation was introduced in v3.7.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v3.7.15
v3.7.15.