Traefik CVE-2026-114638

Exploitation requires Traefik's Kubernetes Ingress NGINX provider to be in use with mTLS client-certificate authentication (auth-tls-secret) configured on multiple hosts, AND two or more auth-tls-secret names that collide after dot-to-dash normalization - causing Traefik to merge their client CA pools. The attacker must additionally possess a valid client certificate issued by the colliding host's CA. Limiting factors: this is not exploitable against a single-host or non-colliding configuration, it is specific to the NGINX Ingress provider path, and it depends on the operator having created the vulnerable secret-naming pattern (reflected as AT:P in CVSS). A side effect also denies service to the legitimate host's clients, who are refused because their own CA is no longer exclusively trusted.

This is a moderate-to-high priority defect rather than an emergency. The official CVSS 4.0 score of 7.0 (HIGH) reflects a scope-crossing authentication bypass: the vector shows network attack vector (AV:N), low attack complexity (AC:L), but a present attack requirement (AT:P) and no privileges or user interaction (PR:N/UI:N), with impact landing entirely on the subsequent/backend system (SC:H/SI:H) rather than Traefik itself (VC:N/VI:N/VA:N). The AT:P flag is the key tempering signal - exploitation is not trivially universal; it depends on a specific naming collision condition (auth-tls-secret names that become identical after dot-to-dash normalization). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active or at-scale exploitation at this time; the finding is a credible reported vulnerability (VulnCheck + vendor GHSA advisory) rather than a confirmed in-the-wild threat. Net: a genuine mTLS trust-boundary failure worth patching promptly in affected Kubernetes environments, but the mandatory precondition (colliding secret names + attacker possession of a cert from the colliding CA) keeps real-world exploitability narrower than the HIGH rating alone suggests.

In a Kubernetes cluster where two Ingress hosts use auth-tls-secret names that collide after dot-to-dash normalization, Traefik's NGINX Ingress provider merges their client CA pools. An attacker holding a valid client certificate issued by one host's CA presents it to a second host that should only trust its own CA, bypassing mTLS client authentication and reaching the protected backend; no public exploit code was identified at time of analysis, and the attack requires the specific secret-name collision to already exist.