Inverted TLS Verification Logic in Traefik HTTP Reverse Proxy

CVE-2025-66491

What is CVE-2025-66491?

Traefik, an HTTP reverse proxy and load balancer, has a critical vulnerability due to inverted TLS verification logic present in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. When set to 'on' to enable backend TLS certificate verification, it instead disables the verification process. This misconfiguration exposes users to potential man-in-the-middle attacks, compromising the security of HTTPS backend communications. The issue is resolved in Traefik version 3.6.3, which corrects this configuration error, ensuring that operators can securely verify backend TLS certificates.

References