CVE-2026-85596
Received Received - Intake

Authentication Bypass in Traefik Kubernetes Ingress Provider

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85596
EUVD
EUVD-2026-71019

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
traefik traefik From 3.7.0 (inc) to 3.7.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Traefik versions 3.7.0 to 3.7.10 affecting the Kubernetes Ingress NGINX provider. It occurs when two Ingress objects share the same host, client CA secret, and authentication mode but have different names. Traefik generates distinct TLS options for these, causing a conflict that forces it to use the default TLS configuration without client certificate requirements. This bypasses intended mTLS authentication for routes configured to require client certificates.

Detection Guidance

Check Traefik version with 'traefik version' command. If running versions >=3.7.0 and <=3.7.10, the system is vulnerable. Inspect Kubernetes Ingress resources for conflicting configurations sharing the same host, client CA secret, and client-authentication mode.

Impact Analysis

An attacker could exploit this to access protected routes without a valid client certificate. This bypasses mutual TLS (mTLS) authentication, potentially allowing unauthorized access to sensitive data or services. The attack requires creating a conflicting Ingress for an existing host but does not need Kubernetes credentials or a client certificate.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (data confidentiality) and HIPAA (protected health information). Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Traefik to version 3.7.11 or later immediately. Review and consolidate Ingress configurations to avoid conflicts. Ensure no two Ingress objects share the same host with identical client CA and authentication mode but different names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85596. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart