github.com/traefik/traefik/v3: Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route

Summary

There is a high severity vulnerability in Traefik's Kubernetes Ingress-NGINX provider. For an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream annotation, the middleware that owns the Ssl-Client-* request headers is attached only to the TLS router, so the plaintext HTTP router generated for the same Ingress forwards those headers exactly as the client sent them. That router normally only issues a redirect, but when nginx.ingress.kubernetes.io/ssl-redirect: "false" is set it reaches the backend, and an unauthenticated client can then supply Ssl-Client-Verify: SUCCESS together with a chosen certificate subject and issuer. A backend that trusts those proxy-generated fields as an mTLS identity authorizes the request even though no client certificate was presented.

Only the Traefik v3.7 line is affected: support for the auth-tls-pass-certificate-to-upstream annotation was added in v3.7.0, and earlier versions do not translate it.

Patches

• https://github.com/traefik/traefik/releases/tag/v3.7.14

For more information

If you have any questions or comments about this advisory, please open an issue.