CyberRota Analysis
AI-GeneratedTraefik versions 3.7.0 to 3.7.10 are vulnerable to an authentication bypass in the Kubernetes Ingress NGINX provider, allowing unauthorized access to routes configured with client certificate authentication. This occurs due to a naming conflict in TLS options, leading to a fallback to default settings that do not enforce client certificate verification. Organizations using affected Traefik versions in conjunction with Nginx and Kubernetes should prioritize upgrading to version 3.7.11 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)