CVE-2026-85596
published 2026-09-04CVE-2026-85596: Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress…
PriorityP359critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.43%
36.8th percentile
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| traefik | traefik | >= 3.7.0 < 3.7.11 | 3.7.11 |
| traefik | traefik | 3.7.0 – 3.7.10 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider.
ghsa_unreviewed·2026-09-04
CVE-2026-85596 [HIGH] CWE-287 Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider.
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.
Red Hat
github.com/traefik/traefik: Traefik: Authentication bypass due to TLS configuration conflict
vendor_redhat·2026-09-04·CVSS 8.2
CVE-2026-85596 [HIGH] CWE-305 github.com/traefik/traefik: Traefik: Authentication bypass due to TLS configuration conflict
github.com/traefik/traefik: Traefik: Authentication bypass due to TLS configuration conflict
A flaw was found in Traefik. This vulnerability allows a remote attacker to bypass authentication, gaining unauthorized access to protected routes. This occurs due to a conflict in how Traefik handles Transport Layer Security (TLS) options when specific Kubernetes Ingress objects are configured. The conflict causes Traefik to use a less secure default configuration, negating the requirement for client certificates.
Statement: A flaw was found in Traefik's Kubernetes Ingress NGINX provider (v3.7.0 through v3.7.10) where TLS options generated for Ingress objects using the auth-tls-secret annotation are incorrectly named using the namespace and Ingress name. When multiple Ingress objects share the s
No detection rules found.
No public exploits indexed.
2026-09-04
Published