CVE-2026-114638: Traefik Auth Bypass Vulnerability

CVE-2026-114638 Overview

CVE-2026-114638 is an improper authentication vulnerability [CWE-287] in Traefik v3 affecting versions v3.7.0 through v3.7.13. The flaw resides in the Kubernetes Ingress NGINX provider, which merges client Certificate Authorities (CAs) when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding a certificate from one host's CA can authenticate to a different host that requires its own client CA. Legitimate clients of the affected host are simultaneously refused access. The issue breaks the mutual TLS (mTLS) trust boundary between tenants sharing a Traefik ingress controller.

Critical Impact

Cross-tenant authentication bypass allows attackers with valid certificates from an unrelated host's CA to access protected hosts, while blocking legitimate client access.

Affected Products

• Traefik v3.7.0
• Traefik v3.7.x releases prior to v3.7.14
• Deployments using the Kubernetes Ingress NGINX provider with auth-tls-secret annotations

Discovery Timeline

• 2026-10-22 - CVE CVE-2026-114638 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114638

Vulnerability Analysis

Traefik's Kubernetes Ingress NGINX provider processes the nginx.ingress.kubernetes.io/auth-tls-secret annotation to configure client certificate validation. The provider normalizes secret names by converting dots to dashes, which creates collisions between distinct secret references. When two or more ingresses specify different auth-tls-secret values that normalize to the same identifier, Traefik merges their client CA pools into a single trust store.

The resulting configuration applies the combined CA bundle to each affected host. Any client holding a certificate signed by any of the merged CAs is accepted, regardless of which host originally referenced that CA. The merge logic simultaneously disrupts the expected single-CA validation path, causing legitimate clients to be refused when their certificate chain no longer matches the first-matched trust configuration.

Root Cause

The root cause is the dot-to-dash normalization applied to Kubernetes secret references without preserving the original identifier for uniqueness checks. The provider treats the normalized string as the key for CA pool storage, so references such as tenant.a.ca and tenant-a-ca collide. The code then appends CAs to the existing pool instead of raising a conflict error or isolating per-host trust stores.

Attack Vector

An attacker who controls or holds a valid certificate from one tenant's CA sends an HTTPS request to a victim host served by the same Traefik instance. If the victim host's auth-tls-secret name collides with the attacker-tenant's secret name after normalization, the merged CA pool accepts the attacker's certificate. No credentials or user interaction are required, and the attack is executed over the network.

The vulnerability does not have a verified public proof-of-concept. See the GitHub Security Advisory and the VulnCheck Advisory for Traefik for technical details.

Detection Methods for CVE-2026-114638

Indicators of Compromise

• Successful mTLS handshakes on hosts where the presented client certificate was issued by a CA belonging to an unrelated tenant or ingress.
• Sudden TLS handshake failures reported by legitimate clients of a host that previously authenticated successfully.
• Multiple Kubernetes Ingress resources referencing auth-tls-secret names that differ only by dots versus dashes.

Detection Strategies

• Audit all Ingress resources for nginx.ingress.kubernetes.io/auth-tls-secret annotations and compare normalized names for collisions.
• Inspect Traefik access logs for TLS client certificate subjects that do not match the expected issuing CA for the requested host.
• Correlate ingress configuration changes with changes in client authentication success and failure rates per host.

Monitoring Recommendations

• Enable Traefik access logging with client certificate metadata, including subject and issuer DN.
• Alert on any mismatch between the issuer DN presented at the TLS layer and the issuer DN expected for the host.
• Track Traefik version inventory across clusters to confirm all instances are at v3.7.14 or later.

How to Mitigate CVE-2026-114638

Immediate Actions Required

• Upgrade Traefik to v3.7.14 or later across all Kubernetes clusters using the Ingress NGINX provider.
• Enumerate all auth-tls-secret annotations and rename any secrets whose normalized identifiers collide.
• Rotate client certificates for any host where a cross-CA acceptance may have occurred during the vulnerable window.

Patch Information

Traefik maintainers released a fix in v3.7.14. The patch is published through the GitHub Security Advisory GHSA-rv2h-qh7j-xrjw. Operators running any v3.7.0 through v3.7.13 release in the Kubernetes Ingress NGINX provider path should upgrade immediately.

Workarounds

• Rename Kubernetes secrets referenced by auth-tls-secret so that no two names normalize to the same identifier after dot-to-dash conversion.
• Temporarily disable the Kubernetes Ingress NGINX provider in Traefik if an upgrade cannot be performed and alternate routing is available.
• Enforce host-level network policies that restrict which clients can reach sensitive ingress hosts until a patched build is deployed.

# Verify running Traefik version and list auth-tls-secret references
kubectl get pods -A -l app.kubernetes.io/name=traefik \
  -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}'

kubectl get ingress -A -o json | \
  jq -r '.items[] | select(.metadata.annotations."nginx.ingress.kubernetes.io/auth-tls-secret") | "\(.metadata.namespace)/\(.metadata.name): \(.metadata.annotations."nginx.ingress.kubernetes.io/auth-tls-secret")"'