GHSA-p8wx-ph99-xgcr: Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.7.15
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Traefik’s Kubernetes Ingress NGINX provider are exposed when mTLS is configured with the auth-tls-secret annotation and another Ingress declares a path on the same host without matching auth-tls settings.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to reach a backend through the affected shared host configuration, where Traefik has fallen back to its default TLS options instead of enforcing client certificates.
Is mTLS disabled for every Ingress by default?
No. The described bypass depends on conflicting or incomplete auth-tls settings across Ingress resources that declare paths for the same host. The issue occurs when the other Ingress does not have matching auth-tls settings.
How can I identify potentially affected configurations?
Review Ingress resources handled by the Kubernetes Ingress NGINX provider and group them by host. Flag hosts where an Ingress uses auth-tls-secret but another Ingress declares a path for that host without matching auth-tls configuration.
What should be done if patching is not immediately possible?
Avoid placing paths from Ingress resources with different auth-tls settings on the same host. Ensure every Ingress declaring paths for a host protected by auth-tls-secret has matching auth-tls settings until the affected Traefik version is replaced.