8.7Hoch

CVE-2026-114638Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision

traefik traefik Veröffentlicht: 2026-10-22 04:43 (vor 12 Tagen)

Beschreibung

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.

Schwachstellentyp (CWE): CWE-287

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
traefik	traefik	3.7.0 – < 3.7.14, fixed 3.7.14

Referenzen und Patches

GitHub Security Advisory (GHSA-rv2h-qh7j-xrjw) vendor-advisoryVendor Advisory
VulnCheck Advisory: Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision third-party-advisoryThird Party Advisory

CPE-Treffer (NVD) (1)

cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* ≥ 3.7.0 < 3.7.14

CVSS-Score

8.7Hoch

Quelle: VulnCheck · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Hoch
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Geändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Alle Scores (4)

cna	CVSS 4.0	7.0Hoch
cna	CVSS 3.1	8.7Hoch
disclosure@vulncheck.com	CVSS 4.0	7.0Hoch
disclosure@vulncheck.com	CVSS 3.1	8.7Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.22%

höher als 12 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-10-21
Veröffentlicht2026-10-22 04:43
Bei IP-DB eingegangen2026-10-24 23:44
Zuletzt aktualisiert2026-10-27 17:17

Vergeben von (CNA): VulnCheck
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Traefik

4.4Mittel

CVE-2026-119573 vor 3 Tagen

Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

traefik traefik

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingres…

5.9Mittel

CVE-2026-119574 vor 3 Tagen

Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

traefik traefik

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket,…

8.7Hoch

CVE-2026-119572 vor 3 Tagen

Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

traefik traefik

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host wit…

7.5Hoch

CVE-2026-114656 vor 12 Tagen

Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

traefik traefik

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by Requ…

8.7Hoch

CVE-2026-114642 vor 12 Tagen

Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

traefik traefik

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticat…

3.7Niedrig

CVE-2026-114641 vor 12 Tagen

Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper

traefik traefik

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send co…