Not Failing Securely ('Failing Open') in Traefik - #VU156700

Vulnerability details

The vulnerability allows a remote attacker to bypass mutual TLS client authentication and access backend services intended to require a client certificate.

The vulnerability exists due to fail-open handling of conflicting TLS options in Traefik's Kubernetes Ingress NGINX provider when multiple Ingress resources declare paths on the same host without matching auth-tls settings. The provider attaches client-authentication TLS options per Ingress rather than per host, causing conflicts to trigger fallback to default TLS options that do not request a client certificate. A remote attacker can send requests without a client certificate to access backend services intended to require mutual TLS authentication.

Affected software

Remediation

External References

• https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr

Related Security Bulletins

• Multiple vulnerabilities in Traefik