CVE-2026-119572
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Traefik Kubernetes Ingress Provider

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119572
EUVD
EUVD-2026-113926

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
traefik traefik 3.7.0-ea.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Traefik versions 3.7.0-ea.1 to 3.7.14 have an authentication bypass flaw in the Kubernetes Ingress NGINX provider. When mTLS is configured via the auth-tls-secret annotation but another Ingress declares a path on the same host without matching auth-tls settings, Traefik incorrectly falls back to default TLS options. This allows unauthenticated attackers to access backends that require client certificates.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive backend services that rely on client certificate authentication. Attackers could bypass security controls and interact with protected resources without proper credentials, potentially leading to data breaches or unauthorized actions.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and authentication, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized access could result in non-compliance penalties or legal consequences.

Mitigation Strategies

Upgrade Traefik to version 3.7.15 or later to address the authentication bypass in the Kubernetes Ingress NGINX provider.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119572. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart