James-Yusuke

**Name of the Vulnerable Software and Affected Versions** Traefik versions 3.7.0 through 3.7.10 **Description** An authentication bypass exists in the Kubernetes Ingress NGINX provider. When an Ingress uses the `nginx.ingress.kubernetes.io/auth-tls-secret` annotation, the generated TLS option is named based on the Ingress namespace and name. If two Ingress objects share the same host, client CA secret, and client-authentication mode, they produce distinct TLS option names. Traefik identifies this as a TLS options conflict and reverts to the default TLS configuration of the entry point, which does not require a client certificate. Consequently, routes configured with `nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"` can be accessed without providing a client certificate. **Recommendations** Update to version 3.7.11.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.11.55 **Description** A TLS option conflict resolution issue allows unauthenticated attackers to bypass client-certificate authentication on multi-host routers. By creating conflicting TLS options across multiple hostnames within a single router rule, the strict mTLS (mutual TLS, a process where both client and server authenticate each other) requirement falls back to default options for all hosts, granting access to protected backends. **Recommendations** Update to version 2.11.55 or later.

**Name of the Vulnerable Software and Affected Versions** Traefik versions 3.6.0 through 3.6.22 Traefik versions 3.7.0 through 3.7.6 **Description** Traefik fails to enforce the `crossProviderNamespaces` allowlist for `IngressRouteTCP` service `serversTransport` references, as the allowlist was only applied to HTTP references. A low-privileged Kubernetes user in a namespace not included in the `crossProviderNamespaces` list can configure `serversTransport: foo@file` on an `IngRouteTCP` service. This allows Traefik to accept a forbidden cross-provider reference and utilize a file-provider `TCPServersTransport`, potentially granting access to privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. **Recommendations** Update Traefik versions 3.6.0 through 3.6.22 to version 3.6.23. Update Traefik versions 3.7.0 through 3.7.6 to version 3.7.7.