CVE-2026-85596

CVE-2026-85596 is an authentication bypass (CWE-287) in the Kubernetes Ingress NGINX provider of Traefik v3.7.0 through v3.7.10. It is triggered when two or more Ingress objects share the same host, reference the same client CA secret via the nginx.ingress.kubernetes.io/auth-tls-secret annotation, and use the same client-authentication mode: because the generated TLS option is named after each Ingress's namespace and name, Traefik ends up with two TLS options for one host, treats this as a conflict, and falls back to the entry point's default TLS configuration, which does not request a client certificate. An attacker can therefore reach a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" without presenting any client certificate, bypassing the intended mutual-TLS authentication; the CVSS 4.0 score of 8.2 reflects high confidentiality impact with no integrity or availability impact. Only Traefik v3.7.x deployments using this provider with the auth-tls annotations are affected, and the issue is fixed in v3.7.11. No public proof of concept, CISA KEV listing, or known in-the-wild exploitation has been reported, and EPSS estimates the 30-day exploitation probability at roughly 0.2%.

What to do: Upgrade to Traefik v3.7.11 or later. Until patched, consolidate Ingresses that share a host and client CA into a single object (or otherwise avoid duplicate TLS-option names for the same host), and check whether any host configured with auth-tls-verify-client: "on" currently accepts TLS connections without a client certificate. Re-verify mTLS enforcement after upgrading.