Authentication Bypass in Traefik Kubernetes Ingress NGINX Provider

CVE-2026-119572

What is CVE-2026-119572?

Traefik versions from 3.7.0-ea.1 up to but not including 3.7.15 contain a vulnerability that allows attackers to bypass authentication under certain conditions. Specifically, when utilizing the Kubernetes Ingress NGINX provider, the configuration for mutual TLS (mTLS) can be silently ignored if another Ingress directs traffic to a conflicting path on the same host. In such a case, Traefik defaults to its standard TLS settings, thereby granting unauthorized users access to services that are intended to enforce strict client authentication via client certificates.

References