8.7Alta

CVE-2026-114638Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision

traefik traefik Publicada: 2026-10-22 04:43 (hace 12 días)

Descripción

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.

Debilidad (CWE): CWE-287

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
traefik	traefik	3.7.0 – < 3.7.14, fixed 3.7.14

Referencias y parches

GitHub Security Advisory (GHSA-rv2h-qh7j-xrjw) vendor-advisoryVendor Advisory
VulnCheck Advisory: Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision third-party-advisoryThird Party Advisory

Coincidencias CPE (NVD) (1)

cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* ≥ 3.7.0 < 3.7.14

Puntuación CVSS

8.7Alta

Fuente: VulnCheck · CVSS 3.1

Vector de ataque: Red
Complejidad: Alta
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Cambiado
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Ninguno

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Todas las puntuaciones (4)

cna	CVSS 4.0	7.0Alta
cna	CVSS 3.1	8.7Alta
disclosure@vulncheck.com	CVSS 4.0	7.0Alta
disclosure@vulncheck.com	CVSS 3.1	8.7Alta

EPSS (probabilidad de explotación en 30 días)

0.22%

superior al 12 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2026-10-21
Publicada2026-10-22 04:43
Llegó a IP-DB2026-10-24 23:44
Última actualización2026-10-27 17:17

Asignada por (CNA): VulnCheck
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Traefik

4.4Media

CVE-2026-119573 hace 3 días

Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

traefik traefik

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingres…

5.9Media

CVE-2026-119574 hace 3 días

Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

traefik traefik

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket,…

8.7Alta

CVE-2026-119572 hace 3 días

Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

traefik traefik

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host wit…

7.5Alta

CVE-2026-114656 hace 12 días

Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

traefik traefik

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by Requ…

8.7Alta

CVE-2026-114642 hace 12 días

Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

traefik traefik

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticat…

3.7Baja

CVE-2026-114641 hace 12 días

Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper

traefik traefik

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send co…