SB2026102197 - Multiple vulnerabilities in Traefik

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102197

SB2026102197 - Multiple vulnerabilities in Traefik

Published: October 21, 2026

Security Bulletin ID SB2026102197
CSH Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Not Failing Securely ('Failing Open') (CVE-ID: N/A)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass mutual TLS client authentication and access backend services intended to require a client certificate.

The vulnerability exists due to fail-open handling of conflicting TLS options in Traefik's Kubernetes Ingress NGINX provider when multiple Ingress resources declare paths on the same host without matching auth-tls settings. The provider attaches client-authentication TLS options per Ingress rather than per host, causing conflicts to trigger fallback to default TLS options that do not request a client certificate. A remote attacker can send requests without a client certificate to access backend services intended to require mutual TLS authentication.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to bypass namespace isolation by using another namespace's CA secret as the client certificate authority for their own routes and determine whether that secret exists and is in use, without disclosing its contents.

The vulnerability exists due to incorrect authorization in Traefik's Kubernetes Ingress NGINX provider when a cached client authentication TLS option is reused without checking cross-namespace access, even with allowCrossNamespaceResources disabled. A remote privileged user can create an Ingress with the nginx.ingress.kubernetes.io/auth-tls-secret annotation referencing another namespace's CA secret already used by another Ingress to enforce that certificate authority on their own routes despite the configured namespace isolation.


Remediation

Install update from vendor's website.

References