CVE-2026-85596 Overview
CVE-2026-85596 is an authentication bypass vulnerability in Traefik's Kubernetes Ingress NGINX provider. The flaw affects Traefik versions >= v3.7.0 and <= v3.7.10. Traefik generates a TLS option name derived from an Ingress namespace and name when processing the nginx.ingress.kubernetes.io/auth-tls-secret annotation. When two Ingress objects share the same host, client CA secret, and client authentication mode, Traefik produces conflicting TLS option names and reverts to the entry point default. The default configuration does not request a client certificate, so routes protected by nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" become reachable without one. The vulnerability is tracked under [CWE-287] Improper Authentication.
Critical Impact
Attackers can reach mTLS-protected Ingress routes without presenting a client certificate when a TLS options collision occurs.
Affected Products
- Traefik v3.7.0 through v3.7.10
- Kubernetes Ingress NGINX provider in Traefik v3.7
- Ingress resources using nginx.ingress.kubernetes.io/auth-tls-secret and auth-tls-verify-client annotations
Discovery Timeline
- 2026-09-04 - CVE-2026-85596 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-85596
Vulnerability Analysis
The Traefik Kubernetes Ingress NGINX provider translates NGINX-style annotations into Traefik TLS configuration objects. For each Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation, Traefik synthesizes a TLSOption resource. The generated option name is derived from the Ingress namespace and name rather than from the effective TLS parameters. This naming scheme guarantees uniqueness per Ingress but does not deduplicate options that are functionally identical.
When two Ingress objects target the same host with the same CA secret and the same verification mode, Traefik registers two distinct TLS options for that host. The router's TLS resolution logic then detects a conflict and cannot select a single option. Rather than fail closed, Traefik falls back to the entry point's default TLS configuration, which does not enforce client certificate presentation.
Root Cause
The root cause is unsafe fallback behavior combined with an option-naming strategy that produces artificial collisions. The provider assumes distinct Ingress names imply distinct TLS requirements, but multiple Ingresses can legitimately share a host and client authentication policy. When collision detection triggers, the fallback silently disables mTLS enforcement instead of retaining the most restrictive policy.
Attack Vector
An attacker on the network sends an HTTPS request to a host served by two or more Ingress objects that share the same host, CA secret, and auth-tls-verify-client setting. Because the TLS options conflict, Traefik answers with the entry point default TLS configuration and completes the handshake without requesting a client certificate. The attacker then reaches the upstream service that was intended to be protected by mutual TLS. No authentication material, credentials, or user interaction is required.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-j994-9gqj-9hwq and the VulnCheck Traefik Authentication Bypass Advisory for advisory-level details.
Detection Methods for CVE-2026-85596
Indicators of Compromise
- Successful HTTPS connections to routes annotated with auth-tls-verify-client: "on" where no client certificate was presented in access logs.
- Traefik logs containing TLS options conflict warnings that reference multiple TLSOption resources bound to the same host.
- Requests to sensitive upstream services originating from client IPs that never completed a mutual TLS handshake.
Detection Strategies
- Enumerate all Kubernetes Ingress objects and identify hosts served by more than one Ingress that share the same auth-tls-secret value.
- Parse Traefik dynamic configuration to correlate router-to-TLS-option mappings and flag hosts where the entry point default is selected despite mTLS annotations.
- Compare application-layer authentication events against TLS session metadata to identify sessions authenticated without client certificates on mTLS-protected paths.
Monitoring Recommendations
- Ship Traefik access and error logs to a central data lake and alert on TLS handshake events lacking a client certificate for annotated Ingresses.
- Monitor for creation or modification of duplicate Ingress resources targeting the same host and CA secret.
- Track the running Traefik version across all clusters and alert on any node reporting v3.7.0 through v3.7.10.
How to Mitigate CVE-2026-85596
Immediate Actions Required
- Upgrade Traefik to v3.7.11 or later on every cluster running the Kubernetes Ingress NGINX provider.
- Audit Ingress resources for host collisions using the nginx.ingress.kubernetes.io/auth-tls-secret annotation and consolidate duplicates.
- Review upstream application logs for requests that reached mTLS-protected routes without an authenticated client identity.
Patch Information
The issue is fixed in Traefik v3.7.11. Only the v3.7 release line is affected. Refer to the GitHub Security Advisory GHSA-j994-9gqj-9hwq for the upstream patch commits and release notes.
Workarounds
- Remove duplicate Ingress objects so that only one Ingress per host references the auth-tls-secret annotation.
- Enforce client certificate validation at the upstream application in addition to the ingress layer until the patch is applied.
- Restrict network access to affected hosts using Kubernetes NetworkPolicy or perimeter firewall rules while remediation is in progress.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
