{"id":"GHSA-rv2h-qh7j-xrjw","kind":"vulnerability","aliases":["GHSA-rv2h-qh7j-xrjw"],"related":[],"title":"Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation is named from the referenced Secret's namespace and name after normalizing them, which replaces every dot with a dash. Two Secrets whose names differ only by a dot and a dash, such as `my.secret` and `my-secret`, therefore produce the same TLS option name, and the Ingress processed second silently reuses the option built for the first one. A host configured to require client certificates issued by its own CA is then gated by another host's CA: certificates from that other CA are accepted, while the host's legitimate clients are refused. In Traefik v3.7.0 to v3.7.10, where the generated name also included the Ingress name, the same collision could occur between Ingresses whose names normalize identically. The provider now keeps the resource names as is in the names it generates. Traefik v2 and Traefik v3 versions before v3.7.0 are not affected: the `auth-tls-secret` annotation is supported by the Ingress NGINX provider since v3.7.0.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik's Kubernetes Ingress NGINX provider names the TLS option for the auth-tls-secret annotation by replacing dots with dashes, so two Secrets like my.secret and my-secret share one option. A host that requires client certificates can then be gated by another host's CA, so certificates from that other CA are accepted while its own legitimate clients are refused.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.14"],"affected":">= v3.7.0, <= v3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-287","ingress-nginx","kubernetes","mtls","package","tls","traefik"],"not_affected_if":["no-auth-tls-secret-annotation","pre-3.7.0","traefik-v2"],"how_to_check":"- Check the Traefik version with `traefik version`; affected builds are `>= 3.7.0` and `<= 3.7.13`.\n- Search Ingress resources for the annotation `nginx.ingress.kubernetes.io/auth-tls-secret` and list the Secret names they reference.\n- Look for Secret names that differ only by a dot versus a dash in the same cluster.","fix":"- Traefik `3.7.14` (fixed version for the v3 line in the affected range `>= 3.7.0, <= 3.7.13`)","status":"open","published_at":"2026-10-07T08:47:52+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","triaged_at":"2026-11-09T22:59:31+00:00","updated_at":"2026-11-09T22:59:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:59:31Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik `3.7.14` (fixed version for the v3 line in the affected range `>= 3.7.0, <= 3.7.13`)","reach":"network","title":"Traefik: colliding TLS secret names let one host accept another host's client CA","impact":"medium","summary":"Traefik's Kubernetes Ingress NGINX provider names the TLS option for the auth-tls-secret annotation by replacing dots with dashes, so two Secrets like my.secret and my-secret share one option. A host that requires client certificates can then be gated by another host's CA, so certificates from that other CA are accepted while its own legitimate clients are refused.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traefik","kubernetes","ingress-nginx","tls","mtls"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Hosts accept client certificates signed by another host's CA.","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version`; affected builds are `>= 3.7.0` and `<= 3.7.13`.\n- Search Ingress resources for the annotation `nginx.ingress.kubernetes.io/auth-tls-secret` and list the Secret names they reference.\n- Look for Secret names that differ only by a dot versus a dash in the same cluster.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["traefik-v2","pre-3.7.0","no-auth-tls-secret-annotation"],"who_is_affected":"Only clusters running Traefik's Kubernetes Ingress NGINX provider with Ingresses that use the auth-tls-secret annotation are exposed. The collision needs two referenced Secrets whose names differ only by a dot and a dash, and Traefik v2 and versions before v3.7.0 are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000841,"input_tokens":5032,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-287':43B '/auth-tls-secret':141C '/traefik/traefik/issues).':326C '/traefik/traefik/releases/tag/v3.7.14':306C '/traefik/traefik/v3':41A 'accept':108B,229C 'advisori':319C 'affect':287C 'also':247C 'annot':68B,142C,293C 'anoth':25A,97B,219C 'auth':7A,65B,290C 'auth-tls-secret':6A,64B,289C 'built':198C 'ca':28A,100B,106B,214C,222C,227C 'carri':137C 'cas':14A 'certif':91B,102B,209C,223C 'client':13A,90B,113B,208C,235C 'collid':5A 'collis':254C 'comment':316C 'configur':205C 'could':255C 'cwe':42B 'dash':73B,162C,174C 'differ':167C 'dot':71B,159C,171C 'everi':158C 'first':201C 'gate':23A,95B,217C 'generat':133C,245C,276C 'ghsa':30A,35A 'ghsa-rv2h-qh7j-xrjw':29A,34A 'github.com':40A,305C,325C 'github.com/traefik/traefik/issues).':324C 'github.com/traefik/traefik/releases/tag/v3.7.14':304C 'github.com/traefik/traefik/v3':39A 'high':120C 'host':21A,26A,87B,98B,204C,220C,232C 'ident':262C 'includ':248C 'inform':309C 'ingress':2A,45B,55B,127C,136C,191C,250C,258C,298C 'ingress-nginx':1A,44B 'issu':210C,323C 'keep':266C 'kubernet':47B,54B,126C 'legitim':112B,234C 'like':77B 'merg':11A 'mtls':48B 'my-secret':80B,179C 'my.secret':78B,177C 'name':10A,58B,144C,152C,166C,188C,246C,251C,260C,269C,274C 'namespac':150C 'nginx':3A,46B,56B,128C,299C 'nginx.ingress.kubernetes.io':140C 'nginx.ingress.kubernetes.io/auth-tls-secret':139C 'normal':154C,261C 'occur':256C 'one':16A,84B,202C 'open':321C 'option':18A,61B,85B,132C,187C,197C 'packag':49B 'patch':303C 'pleas':320C 'process':192C 'produc':183C 'provid':4A,57B,129C,264C,300C 'qh7j':32A,37A 'question':314C 'referenc':147C 'refus':115B,237C 'replac':70B,157C 'requir':89B,207C 'resourc':268C 'reus':195C 'rv2h':31A,36A 'second':193C 'secret':9A,67B,76B,82B,148C,164C,181C,292C 'sever':121C 'share':83B 'silent':194C 'sinc':301C 'summari':116C 'support':295C 'therefor':182C 'tls':8A,17A,50B,60B,66B,131C,186C,291C 'traefik':51B,52B,124C,239C,277C,280C 'two':12A,75B,163C 'v2':278C 'v3':281C 'v3.7.0':240C,284C,302C 'v3.7.10':242C 'version':282C 'vulner':122C 'whose':165C,259C 'xrjw':33A,38A","nicknames":[],"mitigations":[],"who_affected":"Only clusters running Traefik's Kubernetes Ingress NGINX provider with Ingresses that use the auth-tls-secret annotation are exposed. The collision needs two referenced Secrets whose names differ only by a dot and a dash, and Traefik v2 and versions before v3.7.0 are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v3"],"labels":["cwe287","go","high","ingressnginx","kubernetes","mtls","package","tls","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v3':41A 'anoth':25A 'auth':7A 'auth-tls-secret':6A 'ca':28A 'cas':14A 'client':13A 'collid':5A 'gate':23A 'ghsa':30A,35A 'ghsa-rv2h-qh7j-xrjw':29A,34A 'github.com':40A 'github.com/traefik/traefik/v3':39A 'host':21A,26A 'ingress':2A 'ingress-nginx':1A 'merg':11A 'name':10A 'nginx':3A 'one':16A 'option':18A 'provid':4A 'qh7j':32A,37A 'rv2h':31A,36A 'secret':9A 'tls':8A,17A 'two':12A 'xrjw':33A,38A","search_b":"'-287':43B 'accept':108B 'annot':68B 'anoth':97B 'auth':65B 'auth-tls-secret':64B 'ca':100B,106B 'certif':91B,102B 'client':90B,113B 'cwe':42B 'dash':73B 'dot':71B 'gate':95B 'host':87B,98B 'ingress':45B,55B 'ingress-nginx':44B 'kubernet':47B,54B 'legitim':112B 'like':77B 'mtls':48B 'my-secret':80B 'my.secret':78B 'name':58B 'nginx':46B,56B 'one':84B 'option':61B,85B 'packag':49B 'provid':57B 'refus':115B 'replac':70B 'requir':89B 'secret':67B,76B,82B 'share':83B 'tls':50B,60B,66B 'traefik':51B,52B 'two':75B","search_c":"'/auth-tls-secret':141C '/traefik/traefik/issues).':326C '/traefik/traefik/releases/tag/v3.7.14':306C 'accept':229C 'advisori':319C 'affect':287C 'also':247C 'annot':142C,293C 'anoth':219C 'auth':290C 'auth-tls-secret':289C 'built':198C 'ca':214C,222C,227C 'carri':137C 'certif':209C,223C 'client':208C,235C 'collis':254C 'comment':316C 'configur':205C 'could':255C 'dash':162C,174C 'differ':167C 'dot':159C,171C 'everi':158C 'first':201C 'gate':217C 'generat':133C,245C,276C 'github.com':305C,325C 'github.com/traefik/traefik/issues).':324C 'github.com/traefik/traefik/releases/tag/v3.7.14':304C 'high':120C 'host':204C,220C,232C 'ident':262C 'includ':248C 'inform':309C 'ingress':127C,136C,191C,250C,258C,298C 'issu':210C,323C 'keep':266C 'kubernet':126C 'legitim':234C 'my-secret':179C 'my.secret':177C 'name':144C,152C,166C,188C,246C,251C,260C,269C,274C 'namespac':150C 'nginx':128C,299C 'nginx.ingress.kubernetes.io':140C 'nginx.ingress.kubernetes.io/auth-tls-secret':139C 'normal':154C,261C 'occur':256C 'one':202C 'open':321C 'option':132C,187C,197C 'patch':303C 'pleas':320C 'process':192C 'produc':183C 'provid':129C,264C,300C 'question':314C 'referenc':147C 'refus':237C 'replac':157C 'requir':207C 'resourc':268C 'reus':195C 'second':193C 'secret':148C,164C,181C,292C 'sever':121C 'silent':194C 'sinc':301C 'summari':116C 'support':295C 'therefor':182C 'tls':131C,186C,291C 'traefik':124C,239C,277C,280C 'two':163C 'v2':278C 'v3':281C 'v3.7.0':240C,284C,302C 'v3.7.10':242C 'version':282C 'vulner':122C 'whose':165C,259C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-rv2h-qh7j-xrjw","url":"https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw","severity":"high","published_at":"2026-10-07T08:47:52+00:00","modified_at":"2026-10-07T08:47:52+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","fetched_at":"2026-11-09T22:53:33+00:00","note":null}],"documents":[{"id":46267,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:52+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}