High priorityDisclosed

Advisory · CVE-2026-119572

Traefik mTLS bypass via Ingress NGINX provider

Traefik 3.7.0-ea.1 before 3.7.15 silently disables mTLS configured via the auth-tls-secret annotation, letting unauthenticated attackers reach backends that require client certificates.

Advisory published October 30, 2026Independent summary
Vendor
Traefik
Product
Traefik
Identifier / CWE
CVE-2026-119572
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

A locked door is supposed to demand an ID card before letting anyone in. A second sign on the same door quietly removes the card check, so anyone can walk through to the rooms behind it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01mTLS configured

    An Ingress declares mTLS via the auth-tls-secret annotation for a host.

  2. 02Conflicting Ingress

    Another Ingress declares a path on the same host without matching auth-tls settings.

  3. 03Fallback to defaults

    Traefik falls back to default TLS options instead of enforcing the configured mTLS.

  4. 04Unauthenticated access

    Attackers reach backends that were supposed to require client certificates.

What happened

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates. The record rates it high at CVSS 8.7.

The vendor advisory fixes the flaw in Traefik 3.7.15. The failure is silent: the mTLS configuration looks present while the enforcement is gone, so affected clusters may have been exposed without any error surfacing.

What to do

  1. Inventory Traefik deployments and identify Kubernetes Ingress NGINX provider usage with auth-tls-secret annotations.
  2. Upgrade to Traefik 3.7.15 or later.
  3. Audit Ingress objects sharing a host for mismatched auth-tls settings.
  4. Review access logs for the affected backends for unauthenticated requests during the exposure window.
  5. Verify the deployed version and re-test mTLS enforcement after upgrading.

Management note

A silently disabled authentication control is worse than a missing one, because it looks protected. Treat every mTLS-backed service behind an affected Traefik as potentially exposed until the upgrade and the log review are done.