Traefik, from version 3.7.0 through 3.7.13, has an authentication bypass in its Kubernetes Ingress‑NGINX provider that forwards client‑supplied Ssl‑Client‑* headers to the plaintext HTTP router. When ssl‑redirect is disabled and the auth‑tls‑pass‑certificate‑to‑upstream option is enabled, an unauthenticated attacker can send an Ssl‑Client‑Verify: SUCCESS header with arbitrary certificate subject and issuer, causing Traefik to treat the request as if it had been authenticated with that mTLS identity. The result is that the attacker can impersonate an mTLS client, bypassing identity checks that rely on TLS certificates and gaining access to services or resources that would otherwise require mutual TLS authentication.

Affected versions are Traefik Traefik 3.7.0 to 3.7.13. The issue is specific to the Kubernetes Ingress‑NGINX provider within these releases. All other versions of Traefik, including subsequent releases such as 3.7.14 and later, are not vulnerable as the header forwarding logic has been corrected.

The CVSS score of 7 indicates a high severity, and the vulnerability is not currently listed in the CISA KEV catalog, but the lack of an EPSS score means the estimation of exploitation likelihood is uncertain. The attack vector requires an attacker to target a system that is running the vulnerable Traefik version with ssl‑redirect disabled and the auth‑tls‑pass‑certificate‑to‑upstream option enabled; once these conditions are met, the attacker can forge mTLS identity headers in plain HTTP traffic to elevate privileges or access restricted resources. Given that the vulnerability allows direct identity spoofing, the risk to confidentiality, integrity, and availability of sensitive services is significant if the environment trusts Traefik to enforce mTLS.