Authentication Bypass Vulnerability in Traefik's Kubernetes Ingress-NGINX Provider

CVE-2026-114640

What is CVE-2026-114640?

The Traefik Kubernetes Ingress-NGINX provider includes a vulnerability that allows unauthorized access through authentication bypass. Specifically, when 'ssl-redirect' is disabled and 'auth-tls-pass-certificate-to-upstream' is enabled, attackers can exploit the system by sending carefully constructed Ssl-Client-Verify headers that fool the system into confirming mTLS identities. This flaw could allow an attacker to impersonate legitimate clients and gain access to restricted resources within a Kubernetes environment.

References