GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-rv2h-qh7j-xrjw · Package
FIX → v3.7.14
Traefik's Kubernetes Ingress NGINX provider names the TLS option for the auth-tls-secret annotation by replacing dots with dashes, so two Secrets like my.secret and my-secret share one option. A host that requires client certificates can then be gated by another host's CA, so certificates from that other CA are accepted while its own legitimate clients are refused.
first public Oct 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only clusters running Traefik's Kubernetes Ingress NGINX provider with Ingresses that use the auth-tls-secret annotation are exposed. The collision needs two referenced Secrets whose names differ only by a dot and a dash, and Traefik v2 and versions before v3.7.0 are not affected.
Not affected if no-auth-tls-secret-annotation, pre-3.7.0, traefik-v2
Who cares ingress-nginx, kubernetes, mtls, tls, traefik
traefik version; affected builds are >= 3.7.0 and <= 3.7.13.nginx.ingress.kubernetes.io/auth-tls-secret and list the Secret names they reference.Upgrade to v3.7.14
There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation is named from the referenced Secret's namespace and name after normalizing them, which replaces every dot with a dash. Two Secrets whose names differ only by a dot and a dash, such as my.secret and my-secret, therefore produce the same TLS option name, and the Ingress processed second silently reuses the option built for the first one. A host configured to require client certificates issued by its own CA is then gated by another host's CA: certificates from that other CA are accepted, while the host's legitimate clients are refused. In Traefik v3.7.0 to v3.7.10, where the generated name also included the Ingress name, the same collision could occur between Ingresses whose names normalize identically. The provider now keeps the resource names as is in the names it generates. Traefik v2 and Traefik v3 versions before v3.7.0 are not affected: the auth-tls-secret annotation is supported by the Ingress NGINX provider since v3.7.0.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.7.14 (fixed version for the v3 line in the affected range >= 3.7.0, <= 3.7.13)