---
id: "GHSA-rv2h-qh7j-xrjw"
page: "https://infrastack.ai/live/GHSA-rv2h-qh7j-xrjw"
kind: "vulnerability"
aliases: ["GHSA-rv2h-qh7j-xrjw"]
title: "Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.14"], "affected": ">= v3.7.0, <= v3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-287", "ingress-nginx", "kubernetes", "mtls", "package", "tls", "traefik"]
not_affected_if: ["no-auth-tls-secret-annotation", "pre-3.7.0", "traefik-v2"]
published_at: "2026-10-07T08:47:52+00:00"
first_seen_at: "2026-11-09T22:53:33+00:00"
updated_at: "2026-11-09T22:59:31+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw", "first_seen_at": "2026-11-09T22:53:33+00:00"}]
exploit_sources: []
---

# Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA

Link for people: https://infrastack.ai/live/GHSA-rv2h-qh7j-xrjw (this .md is for agents)

Traefik's Kubernetes Ingress NGINX provider names the TLS option for the auth-tls-secret annotation by replacing dots with dashes, so two Secrets like my.secret and my-secret share one option. A host that requires client certificates can then be gated by another host's CA, so certificates from that other CA are accepted while its own legitimate clients are refused.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.7.0, <= v3.7.13 fixed v3.7.14

## How to check

- Check the Traefik version with `traefik version`; affected builds are `>= 3.7.0` and `<= 3.7.13`.
- Search Ingress resources for the annotation `nginx.ingress.kubernetes.io/auth-tls-secret` and list the Secret names they reference.
- Look for Secret names that differ only by a dot versus a dash in the same cluster.

## Fix

- Traefik `3.7.14` (fixed version for the v3 line in the affected range `>= 3.7.0, <= 3.7.13`)

## Timeline

- 2026-11-09T22:53:33+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw

## From the sources

## Summary

There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation is named from the referenced Secret's namespace and name after normalizing them, which replaces every dot with a dash. Two Secrets whose names differ only by a dot and a dash, such as `my.secret` and `my-secret`, therefore produce the same TLS option name, and the Ingress processed second silently reuses the option built for the first one. A host configured to require client certificates issued by its own CA is then gated by another host's CA: certificates from that other CA are accepted, while the host's legitimate clients are refused. In Traefik v3.7.0 to v3.7.10, where the generated name also included the Ingress name, the same collision could occur between Ingresses whose names normalize identically. The provider now keeps the resource names as is in the names it generates. Traefik v2 and Traefik v3 versions before v3.7.0 are not affected: the `auth-tls-secret` annotation is supported by the Ingress NGINX provider since v3.7.0.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.14

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_