Traefik Proxy CVE-2026-114640

Exploitable only when ALL of the following hold: Traefik 3.7.0-3.7.13 is using the Kubernetes Ingress-NGINX provider; the 'ssl-redirect' option is DISABLED (so the plaintext HTTP router is reachable); and 'auth-tls-pass-certificate-to-upstream' is ENABLED, causing Traefik to forward client-supplied Ssl-Client-* headers. Exploitation further requires an upstream backend that trusts those forwarded headers (notably 'Ssl-Client-Verify: SUCCESS' plus the certificate subject/issuer) as proof of mTLS identity. Limiting factors: this specific combination is not the default, the flaw affects only the plaintext HTTP router, and the AT:P metric reflects that the required non-default configuration gates exploitation; the attack itself needs no authentication or user interaction.

This is a genuine but conditionally-gated authentication bypass (CWE-290), not a blanket critical. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms a network-reachable, unauthenticated, low-complexity attack - but the AT:P (Attack Requirements: Present) metric explicitly encodes that exploitation depends on a specific non-default configuration, which is the single most important risk-limiting signal here. Notably, the vector assigns NO impact to the vulnerable system itself (VC:N/VI:N/VA:N) and instead places the full impact on the subsequent/upstream system (SC:H/SI:H), correctly reflecting that Traefik merely forwards the forged identity while the real damage lands on the protected backend that trusts those headers; defenders whose backends do not act on Ssl-Client-* headers face materially lower risk. EPSS score is not provided in the input, KEV status is not listed (treat as not actively exploited), and no public exploit is referenced - so there is no evidence of in-the-wild or widespread automated exploitation at this time. The net picture: a credible, easy-to-trigger bypass for the subset of deployments matching the required configuration, meriting prompt patching for affected Traefik 3.7.x users, but it does not rise to a drop-everything emergency for the general population given the configuration precondition and absence of exploitation signals.

An organization runs Traefik (3.7.0-3.7.13) using the Kubernetes Ingress-NGINX provider with ssl-redirect disabled and auth-tls-pass-certificate-to-upstream enabled, and has a backend that authorizes requests based on forwarded mTLS identity headers. A remote unauthenticated attacker sends a plaintext HTTP request carrying a self-chosen 'Ssl-Client-Verify: SUCCESS' header along with a forged certificate subject and issuer, which Traefik forwards verbatim, causing the backend to treat the attacker as a verified mTLS client and grant access. No public exploit code is referenced, but the attack requires only a crafted HTTP request and no special tooling.