---
id: "GHSA-p8wx-ph99-xgcr"
page: "https://infrastack.ai/live/GHSA-p8wx-ph99-xgcr"
kind: "vulnerability"
aliases: ["GHSA-p8wx-ph99-xgcr"]
title: "ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.15"], "affected": ">= v3.7.0-ea.1, <= v3.7.14", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-287", "cwe-636", "infrastructure", "ingress-nginx", "kubernetes", "mtls", "traefik"]
not_affected_if: ["default-config-no-auth-tls", "pre-v3.7-traefik", "single-ingress-per-host", "strict-tls-options"]
published_at: "2026-10-16T08:00:58+00:00"
first_seen_at: "2026-11-09T22:53:32+00:00"
updated_at: "2026-11-09T22:54:32+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr", "first_seen_at": "2026-11-09T22:53:32+00:00"}]
exploit_sources: []
---

# ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation

Link for people: https://infrastack.ai/live/GHSA-p8wx-ph99-xgcr (this .md is for agents)

When Traefik's Kubernetes Ingress NGINX provider serves a host where one Ingress sets auth-tls-secret and another Ingress on the same host does not, the client certificate requirement is dropped for that host. An unauthenticated remote attacker can then reach backends that were meant to require a client certificate.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.7.0-ea.1, <= v3.7.14 fixed v3.7.15

## How to check

- Check the Traefik version with `traefik version`; affected builds are `>= v3.7.0-ea.1` and `<= v3.7.14`.
- List Ingresses per host with `kubectl get ingress -A -o yaml` and look for hosts where some Ingresses carry `nginx.ingress.kubernetes.io/auth-tls-secret` and others on the same host do not.
- Confirm `core.strictTLSOptions` is not enabled, since the advisory says strict mode avoids the fallback.

## Fix

- Upgrade Traefik to `v3.7.15`.

## Timeline

- 2026-11-09T22:53:32+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr

## From the sources

## Summary

There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider where mutual TLS client authentication configured with the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation is silently disabled for a host when another Ingress declares a path on that same host without the same auth-tls settings. The provider attaches the client-authentication TLS option per Ingress rather than per host, so the conflicting TLS options on the host make Traefik fall back to the default TLS options, which do not request a client certificate, unless `core.strictTLSOptions` is enabled. An unauthenticated remote attacker can then reach the backends that were meant to require a client certificate. Traefik v2 and Traefik v3 versions before v3.7.0 are not affected: support for the `auth-tls-secret` annotation was introduced in v3.7.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.15

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_