Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

Summary

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.

Remediation

1. Inventory every traefik traefik deployment, including staging.
2. Upgrade traefik traefik to 3.7.15.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr
• Advisoryhttps://www.vulncheck.com/advisories/traefik-3.7.0-ea.1-before-3.7.15-mtls-bypass-via-ingress-nginx-provider