{"schema":"threatline.record/2","record":{"id":"GHSA-mwrr-6hp4-pxr6","aliases":["GHSA-mwrr-6hp4-pxr6"],"summary":"Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route","details":"## Summary\n\nThere is a high severity vulnerability in Traefik's Kubernetes Ingress-NGINX provider. For an Ingress carrying the `nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream` annotation, the middleware that owns the `Ssl-Client-*` request headers is attached only to the TLS router, so the plaintext HTTP router generated for the same Ingress forwards those headers exactly as the client sent them. That router normally only issues a redirect, but when `nginx.ingress.kubernetes.io/ssl-redirect: \"false\"` is set it reaches the backend, and an unauthenticated client can then supply `Ssl-Client-Verify: SUCCESS` together with a chosen certificate subject and issuer. A backend that trusts those proxy-generated fields as an mTLS identity authorizes the request even though no client certificate was presented.\n\nOnly the Traefik v3.7 line is affected: support for the `auth-tls-pass-certificate-to-upstream` annotation was added in v3.7.0, and earlier versions do not translate it.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n","categories":["Unclassified"],"product":"github.com/traefik/traefik/v3","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6","source_modified_at":"2026-10-07T08:47:36Z","fetched_at":"2026-10-25T01:05:06.841276Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v3"},"range":">= v3.7.0, <= v3.7.13"}],"fixed_versions":[],"cvss":7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-07T08:47:36Z","modified_at":"2026-10-07T08:47:36Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6","fetched_at":"2026-10-25T01:05:06.841276Z","source_modified_at":"2026-10-07T08:47:36Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T08:47:36Z","content_hash":"4ab5786a06e59e8ed29c59cb3167cc20d65b511e121ac1df6f71f290efd57ca4"}}