All vulnerabilities
CVE-2026-114640GHSA-mwrr-6hp4-pxr6

Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router

traefik traefik
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.7.14Fixed versionCVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.

Text from CVE List

Affected versions 2

  • traefikaffected: 3.7.0 before 3.7.14CVE List
  • traefikunaffected: 3.7.14CVE List

References 2