CVE-2026-119572— Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

Quick assessment

Affected

traefik traefik

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Traefik 版本从 3.7.0-ea.1 到 3.7.15（不含 3.7.15）在 Kubernetes Ingress NGINX 提供者中存在一个身份验证绕过漏洞。该漏洞会静默禁用通过注解配置的 mTLS（双向 TLS）。当另一个 Ingress 在同一主机上声明路径但未设置匹配的配置时，Traefik 将回退到默认 TLS 选项，导致未经验证的攻击者能够访问本应要求客户端证书的后端服务。

CVSS 8.7 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

Source: CVE Program / CVE List V5

Vulnerability Description

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
traefik	traefik	3.7.0-ea.1 ~ 3.7.15	-

II. Public POCs for CVE-2026-119572

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119572

请登录查看更多情报信息。

Other References for CVE-2026-119572 (2)

https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr vendor-advisory
https://www.vulncheck.com/advisories/traefik-3.7.0-ea.1-before-3.7.15-mtls-bypass-via-ingress-nginx-provider third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119572

Same Patch Batch · traefik · 2026-10-30 · 3 CVEs total

CVE-2026-119574	5.9 MEDIUM	Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service
CVE-2026-119573	4.4 MEDIUM	Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

IV. Related Vulnerabilities

Same product: traefik

Same vendor: traefik

Same weakness: CWE-287