Mohi@disismohi
If you run Traefik Ingress with mTLS, audit your configs Saturday. CVE-2026-119572 silently disables client cert validation under specific conditions. No error, no log.
1000025
94 followersView on X
CVE-2026-119572
LOWCVSS 7.0 · HIGHSignal is active with 2 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-287
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 2 mentions across 1 observed day
What's happening
- 2 total mentions across 1 day
Deep dive
Activity timeline2 mentions / 1d
Referenced assets1 URL
By indicator
Full discourse2 posts
- Mohi@disismohi
What's your process for testing ingress mTLS enforcement after config changes? This bug shows why that test matters. source: https://nvd.nist.gov/vuln/detail/CVE-2026-119572
000002394 followersView on X