Authorization Bypass in Traefik Kubernetes Ingress NGINX Provider

CVE-2026-119573

What is CVE-2026-119573?

Traefik versions prior to 3.7.15 are susceptible to an authorization bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw allows users with the capability to create Ingresses to exploit the auth-tls-secret annotation, bypassing cross-namespace checks. By reusing cached client authentication TLS options, attackers can reference a certificate authority (CA) secret from another namespace, potentially revealing its existence without accessing its contents. This vulnerability can lead to security misconfigurations and unauthorized access.

References