CVE-2026-114640

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.0 through 3.7.13

Description An authentication bypass exists in the Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled and auth-tls-pass-certificate-to-upstream is enabled, unauthenticated attackers can send the Ssl-Client-Verify: SUCCESS header with a chosen certificate subject and issuer to impersonate mTLS (mutual Transport Layer Security) identities.

Recommendations Update Traefik to version 3.7.14. As a temporary mitigation, ensure ssl-redirect is enabled or disable the auth-tls-pass-certificate-to-upstream setting.