CVE-2026-85596: Traefik v3.7 Authentication Bypass via TLS Option Conflict
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefik Kubernetes Ingress NGINX providerto a version that resolves this vulnerability.Fixed in v3.7.11
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments running Traefik v3.7.0 through v3.7.10 with the Kubernetes Ingress NGINX provider are affected when two Ingress objects share a host, client CA secret, and client-authentication mode. The affected route must use nginx.ingress.kubernetes.io/auth-tls-secret and have nginx.ingress.kubernetes.io/auth-tls-verify-client set to "on".
What does an attacker need to exploit the issue?
An attacker needs network access to a route whose intended client-certificate requirement is bypassed by the TLS options conflict. They do not need to present a client certificate once Traefik falls back to the entry point's default TLS configuration.
How can I tell whether a route is currently vulnerable?
Review Ingress objects for the same host and identify pairs that use the same auth-tls-secret and client-authentication mode. If those Ingresses run on Traefik v3.7.0 through v3.7.10 and client verification is enabled, the generated distinct TLS option names can trigger the fallback.
What should be done if an immediate upgrade is not possible?
Avoid the conflicting Ingress arrangement by ensuring that Ingress objects sharing a host do not create distinct TLS options while using the same client CA secret and client-authentication mode. Upgrade to Traefik v3.7.11 when possible, as it fixes the issue.