CVE-2026-114640: Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client- headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in v3.7.14
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Traefik deployments using the Kubernetes Ingress-NGINX provider are affected if they run a version from 3.7.0 up to, but not including, 3.7.14 and have both ssl-redirect disabled and auth-tls-pass-certificate-to-upstream enabled.
What does an attacker need to exploit the bypass?
The attacker does not need prior authentication or user interaction. They need network access to the plaintext HTTP router and can submit Ssl-Client-* headers, including Ssl-Client-Verify: SUCCESS, with a chosen certificate subject and issuer.
How can we determine whether our configuration is vulnerable?
Check whether the Traefik version is earlier than 3.7.14 within the affected 3.7.x range, whether the Kubernetes Ingress-NGINX provider is in use, and whether ssl-redirect is disabled while auth-tls-pass-certificate-to-upstream is enabled. A vulnerable configuration permits client-supplied Ssl-Client-* headers on the plaintext HTTP router.