Authentication Bypass by Spoofing in Traefik - #VU153913
Published: October 7, 2026
Vulnerability details
The vulnerability allows a remote attacker to impersonate a client certificate identity and bypass backend authentication.
The vulnerability exists due to improper verification of client identity headers in Traefik's Kubernetes Ingress-NGINX provider when handling plaintext HTTP requests for an Ingress configured to forward client certificate information upstream. A remote attacker can send forged Ssl-Client-* headers, including Ssl-Client-Verify: SUCCESS and a chosen certificate subject and issuer, to impersonate a client certificate identity and bypass backend authentication.
Exploitation requires the nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream annotation, nginx.ingress.kubernetes.io/ssl-redirect set to "false", and a backend that trusts these headers as an mTLS identity. No client certificate needs to be presented. The identity-header middleware is attached only to the TLS router, not the plaintext HTTP router.