8.7Yüksek

CVE-2026-114640Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router

traefik traefik Yayım: 2026-10-22 04:43 (12 gün önce)

Açıklama

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.

Zayıflık türü (CWE): CWE-290

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
traefik	traefik	3.7.0 – < 3.7.14, fixed 3.7.14

Kaynaklar ve yamalar

GitHub Security Advisory (GHSA-mwrr-6hp4-pxr6) vendor-advisoryVendor Advisory
VulnCheck Advisory: Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router third-party-advisoryThird Party Advisory

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* ≥ 3.7.0 < 3.7.14

CVSS puanı

8.7Yüksek

Kaynak: VulnCheck · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Yüksek
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişir
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Tüm puanlar (4)

cna	CVSS 4.0	7.0Yüksek
cna	CVSS 3.1	8.7Yüksek
disclosure@vulncheck.com	CVSS 4.0	7.0Yüksek
disclosure@vulncheck.com	CVSS 3.1	8.7Yüksek

EPSS (30 günde istismar olasılığı)

0.19%

tüm CVE'lerin %9'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-10-21
Yayımlandı2026-10-22 04:43
IP-DB'ye ulaştı2026-10-24 23:44
Son güncelleme2026-10-28 06:17

Numarayı veren (CNA): VulnCheck
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Traefik

4.4Orta

CVE-2026-119573 3 gün önce

Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

traefik traefik

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingres…

5.9Orta

CVE-2026-119574 3 gün önce

Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

traefik traefik

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket,…

8.7Yüksek

CVE-2026-119572 3 gün önce

Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

traefik traefik

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host wit…

7.5Yüksek

CVE-2026-114656 12 gün önce

Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

traefik traefik

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by Requ…

8.7Yüksek

CVE-2026-114642 12 gün önce

Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

traefik traefik

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticat…

3.7Düşük

CVE-2026-114641 12 gün önce

Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper

traefik traefik

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send co…