CVE-2026-114638: Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision
Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Traefik versions from 3.7.0 before 3.7.14 are affected when using the Kubernetes Ingress NGINX provider and client TLS authentication configured through auth-tls-secret values whose names collide after dot-to-dash normalization.
What does an attacker need to exploit the vulnerability?
An attacker needs a client certificate issued by the CA configured for another host whose auth-tls-secret name collides after normalization. That certificate may then be accepted by a host intended to trust a different client CA.
What is the operational impact of a secret-name collision?
The affected host can accept clients authenticated under another host's CA, while legitimate clients using the host's intended CA can be refused. This can result in both unauthorized access and a denial of access for valid clients.
How can I identify potentially affected configurations?
Review auth-tls-secret names used by hosts in the Kubernetes Ingress NGINX provider and check whether distinct names become identical when dots are replaced with dashes. Such collisions indicate configurations at risk on affected Traefik versions.