SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-85596

CRITICAL · CVSS 9.8 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-04 · Last synced 2026-09-19

CyberRota Analysis

AI-Generated

Traefik versions 3.7.0 to 3.7.10 are vulnerable to an authentication bypass in the Kubernetes Ingress NGINX provider, allowing unauthorized access to routes configured with client certificate authentication. This occurs due to a naming conflict in TLS options, leading to a fallback to default settings that do not enforce client certificate verification. Organizations using affected Traefik versions in conjunction with Nginx and Kubernetes should prioritize upgrading to version 3.7.11 to mitigate this high-severity vulnerability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-85596
Severity
CRITICAL
CVSS
9.8
EPSS
0.24%
Nginx Kubernetes

Original NVD Description

Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.

Related CVEs

Other vulnerabilities affecting the same vendor(s)