Incorrect authorization in Traefik - #VU156701
Published: October 21, 2026
Vulnerability details
The vulnerability allows a remote privileged user to bypass namespace isolation by using another namespace's CA secret as the client certificate authority for their own routes and determine whether that secret exists and is in use, without disclosing its contents.
The vulnerability exists due to incorrect authorization in Traefik's Kubernetes Ingress NGINX provider when a cached client authentication TLS option is reused without checking cross-namespace access, even with allowCrossNamespaceResources disabled. A remote privileged user can create an Ingress with the nginx.ingress.kubernetes.io/auth-tls-secret annotation referencing another namespace's CA secret already used by another Ingress to enforce that certificate authority on their own routes despite the configured namespace isolation.