Vulnerabilities

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when…

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

F5, Kubernetes

Product

NGINX, Squid / HAProxy / Varnish, Kubernetes

CVSS

8.7

EPSS

0.002 (p12)

Exposure class

Web platform, Edge / VPN / firewall, Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-114638 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 22
   CVE NVD 10d ago

   Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate…

   CVSS 7.5 CVE-2026-114656
2. 22
   CVE NVD 10d ago

   Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards…

   CVSS 8.7 CVE-2026-114640 Kubernetes
3. 28
   CVE NVD 10d ago

   Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an…

   CVSS 8.7 CVE-2026-114639 Microsoft
4. 28
   CVE NVD 10d ago

   Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin…

   CVSS 8.7 CVE-2026-114637 Microsoft
5. 22
   CVE NVD 10d ago

   Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil.

   CVSS 8.7 CVE-2026-114635