Database/Container, Kubernetes & orchestration
Traefik: plaintext HTTP router forwards client-supplied Ssl-Client-* headers, allowing mTLS identity spoofing
Impact
When auth-tls-pass-certificate-to-upstream is set and ssl-redirect is disabled, Traefik's plaintext HTTP router passes attacker-controlled Ssl-Client-* headers straight through to the backend. An unauthenticated caller can send Ssl-Client-Verify: SUCCESS with any subject and issuer it likes and the backend will treat it as a verified mTLS client. Any service that trusts those headers for authorization - a common pattern for internal APIs, schedulers and model endpoints behind an ingress - can be impersonated as an arbitrary identity, including an administrative one.
Who can reach it
Unauthenticated, over the network. The attacker needs to reach Traefik's plain HTTP entry point with the Ingress host and set its own request headers.
What to do
Upgrade Traefik to v3.7.14 and roll the ingress controller. As an immediate mitigation, re-enable ssl-redirect on affected Ingresses or stop backends from trusting Ssl-Client-* headers; controller restart only, no node maintenance.
References
Related entries
- Traefik: mTLS silently disabled when another Ingress shares the host, bypassing client-cert authCVE-2026-119572 · Traefik (Kubernetes Ingress NGINX provider, auth-tls-secret mTLS)High
- Traefik: Service middleware annotation escapes crossProviderNamespaces restrictionsCVE-2026-85594 · Traefik Kubernetes Ingress provider (traefik.ingress.kubernetes.io/service.middlewares annotation)High
- Cilium: A user who can create CiliumNetworkPolicy in one namespace affects traffic cluster-wideCVE-2023-41333 · CiliumMedium
- Docker / moby: Classic builder cache poisoning for images built FROM scratchCVE-2024-24557 · Docker / mobyMedium
- Kyverno: policy Service Call resolves external addresses and ships policy context off-clusterCVE-2025-15613 · Kyverno admission controller (policy apiCall Service Call)Medium
- Kata Containers: A malicious host can circumvent guest protectionsCVE-2025-58354 · Kata ContainersMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.