Traefik v3.7 Authentication Bypass via TLS Option Conflict

Description

Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.

Scores

EPSS (exploitation in 30 days)

0.43% · top 62% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.

Weakness

• CWE-287: Improper Authentication (opens in a new tab)All about CWE-287 and its CVEs

Affected products

• traefik · traefik

  • affected 3.7.0 – ≤ 3.7.10

References (2)

• GitHub Security Advisory (GHSA-j994-9gqj-9hwq) (opens in a new tab)vendor-advisory
• VulnCheck Advisory: Traefik v3.7 Authentication Bypass via TLS Option Conflict (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-85596](https://trackcve.app/badge/CVE-2026-85596.svg)](https://trackcve.app/cve/CVE-2026-85596)

Record last updated 8 Oct 2026, 15:51 UTC.