Database/Container, Kubernetes & orchestration
Traefik: client CAs are merged when auth-tls-secret names collide after dot-to-dash normalization
Impact
Traefik normalizes auth-tls-secret names by turning dots into dashes, so two different secrets can collide into one key and have their client CA pools merged. A caller holding a certificate from one host's CA is then accepted by a different host that was supposed to require its own CA, while that host's legitimate clients can be refused - so the flaw both breaks the mTLS trust boundary between tenants and causes an outage for the host whose CA was displaced. On a multi-tenant cluster where mTLS is the separation between namespaces or customers, this is a cross-tenant authentication bypass rather than a misconfiguration.
Who can reach it
Network-reachable and unauthenticated in the sense that no cluster access is needed: the attacker only needs a valid client certificate issued by some other host's CA configured in the same Traefik instance, plus a secret-name collision to exist.
What to do
Upgrade Traefik to v3.7.14 and restart the ingress controller pods. Until then, audit auth-tls-secret references for names that collide once dots are replaced with dashes and rename the secrets so the normalized keys are unique.
References
Related entries
- Traefik: plaintext HTTP router forwards client-supplied Ssl-Client-* headers, allowing mTLS identity spoofingCVE-2026-114640 · Traefik (Kubernetes Ingress NGINX provider, Ssl-Client-* header forwarding)High
- Traefik: mTLS silently disabled when another Ingress shares the host, bypassing client-cert authCVE-2026-119572 · Traefik (Kubernetes Ingress NGINX provider, auth-tls-secret mTLS)High
- Traefik: Service middleware annotation escapes crossProviderNamespaces restrictionsCVE-2026-85594 · Traefik Kubernetes Ingress provider (traefik.ingress.kubernetes.io/service.middlewares annotation)High
- Cilium: A user who can create CiliumNetworkPolicy in one namespace affects traffic cluster-wideCVE-2023-41333 · CiliumMedium
- Docker / moby: Classic builder cache poisoning for images built FROM scratchCVE-2024-24557 · Docker / mobyMedium
- Kyverno: policy Service Call resolves external addresses and ships policy context off-clusterCVE-2025-15613 · Kyverno admission controller (policy apiCall Service Call)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.