Authentication Bypass in Traefik Kubernetes Ingress NGINX Provider

CVE-2026-85596

What is CVE-2026-85596?

Traefik versions from v3.7.0 to v3.7.10 are vulnerable to an authentication bypass due to a TLS options conflict in the Kubernetes Ingress NGINX provider. This vulnerability arises when two Ingress objects, sharing the same host and client CA secret, create distinct TLS option names. As a result, Traefik defaults to its entry point's configuration, which does not require a client certificate. Consequently, routes configured with client certificate validation become accessible without proper authentication, resulting in potential unauthorized access. Users are advised to upgrade to Traefik v3.7.11 to mitigate this issue.

References