CVE-2026-119573
Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Traefik Kubernetes Ingress Provider

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119573
EUVD
EUVD-2026-113927

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
traefik traefik 3.7.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Traefik 3.7.11 before 3.7.15 has an authorization bypass in the Kubernetes Ingress NGINX provider. It skips cross-namespace checks on the auth-tls-secret annotation when a cached client authentication TLS option is reused. This allows users who can create Ingresses to reference another namespace's CA secret without proper authorization.

Impact Analysis

An attacker with Ingress creation permissions could exploit this to enforce TLS authentication from another namespace on their own routes. They could also determine if a CA secret exists in another namespace without accessing its contents.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and data protection, such as GDPR's principle of least privilege or HIPAA's access control safeguards. Unauthorized access to namespace secrets could lead to non-compliance.

Mitigation Strategies

Upgrade Traefik to version 3.7.15 or later to address the authorization bypass in the Kubernetes Ingress NGINX provider.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart