Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1046
_____________________________________________________________________

DATE                : 19/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running traefik/v3 (Go) versions prior
                                     to 3.7.15.

====================================================================
https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr
https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj
_____________________________________________________________________

ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for
a host when another Ingress on the same host has no matching auth-tls
annotation

This report was submitted with AI assistance
High
kevinpollet published GHSA-p8wx-ph99-xgcr

Package
github.com/traefik/traefik/v3 (Go)

Affected versions
>= v3.7.0-ea.1, <= v3.7.14

Patched versions
v3.7.15


Description

Summary

There is a high severity vulnerability in Traefik's Kubernetes Ingress
NGINX provider where mutual TLS client authentication configured with the
nginx.ingress.kubernetes.io/auth-tls-secret annotation is silently
disabled for a host when another Ingress declares a path on that same host
without the same auth-tls settings. The provider attaches the
client-authentication TLS option per Ingress rather than per host, so the
conflicting TLS options on the host make Traefik fall back to the default 
TLS options, which do not request a client certificate, unless
core.strictTLSOptions is enabled. An unauthenticated remote attacker can
then reach the backends that were meant to require a client certificate.
Traefik v2 and Traefik v3 versions before v3.7.0 are not affected: support
for the auth-tls-secret annotation was introduced in v3.7.


Patches

    https://github.com/traefik/traefik/releases/tag/v3.7.15

For more information

If you have any questions or comments about this advisory, please open an
issue.


Severity
High
7.0/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector Network
Attack Complexity Low
Attack Requirements Present
Privileges Required None
User interaction None
Vulnerable System Impact Metrics
Confidentiality None
Integrity None
Availability None
Subsequent System Impact Metrics
Confidentiality High
Integrity High
Availability None
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

CVE ID
No known CVE

Weaknesses
Weakness CWE-287
Weakness CWE-636

Credits

    @ba-am ba-am Reporter

_____________________________________________________________________


Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the
cross-namespace authorization check, letting an Ingress use another
namespace's CA secret

Low
kevinpollet published GHSA-28hp-c82p-8vqj

Package
github.com/traefik/traefik/v3 (Go)

Affected versions
>= v3.7.11, <= v3.7.14

Patched versions
v3.7.15


Description

Summary

There is a low severity vulnerability in Traefik's Kubernetes Ingress NGINX
provider. With allowCrossNamespaceResources disabled (the default), the
cross-namespace check on the nginx.ingress.kubernetes.io/auth-tls-secret 
only runs when a client authentication TLS option is first built: a later
Ingress referencing a CA secret already used by another Ingress reuses the
shared TLS option without being checked. A user allowed to create Ingresses
in one namespace can therefore have a CA secret from another namespace
enforced as the client certificate authority of their own routes, bypassing
the configured namespace isolation, and learn whether that secret exists and
is in use; the secret's contents are not disclosed. The issue was introduced
in v3.7.11, when client authentication TLS options started being shared across
Ingresses; earlier versions are not affected, and Traefik v2 is not affected
since it does not include the Kubernetes Ingress NGINX provider.


Patches

    https://github.com/traefik/traefik/releases/tag/v3.7.15

For more information

If you have any questions or comments about this advisory, please open
an issue.


Severity
Low
2.0/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector Network
Attack Complexity Low
Attack Requirements Present
Privileges Required High
User interaction None
Vulnerable System Impact Metrics
Confidentiality None
Integrity Low
Availability None
Subsequent System Impact Metrics
Confidentiality Low
Integrity None
Availability None
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N

CVE ID
No known CVE

Weaknesses
Weakness CWE-863

Credits

    @lavkumarv lavkumarv Reporter



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================