Traefik versions before 3.7.14 contain a flaw in the Kubernetes Ingress NGINX provider that merges client Certificate Authorities when authentication TLS secrets collide after transforming dots to dashes. This mix‑up allows an attacker in possession of a certificate signed by another host’s CA to authenticate as a legitimate client to a host that requires its own client CA, while legitimate clients are simultaneously rejected. The vulnerability is classified as an improper authentication weakness (CWE‑287).

Traefik, versions 3.7.0 through 3.7.13, when using the Kubernetes Ingress NGINX provider with auth‑tls‑secret names that conflict after dot‑to‑dash normalization.

The CVSS score is 7, indicating a high severity in terms of potential impact. Exploitation requires the attacker to obtain a client certificate issued by another host’s CA and to target a host configured with an auth‑tls‑secret that shares a normalized name. When these conditions are met, the attacker can gain unauthorized access while legitimate clients are denied, effectively creating a denial‑of‑service scenario. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the technical nature of the flaw and the high CVSS suggest that it should be treated with considerable urgency.