Traefik 3.7.0-ea.1 through 3.7.14 contains an authentication bypass in the Kubernetes Ingress NGINX provider that silently ignores the auth‑tls-secret annotation. As a result, mTLS configured for a host is disabled and Traefik falls back to default TLS settings, allowing unauthenticated requests to reach backends that normally require client certificates. This flaw is identified as CWE-287 and can lead to unauthorized access to protected services.

Traefik version 3.7.0-ea.1 up to 3.7.14 when used with the Kubernetes Ingress NGINX provider is affected. The vulnerability requires that the Ingress resources be configured for a host that uses the auth-tls-secret annotation to enforce client certificates.

The CVSS score of 7 indicates a moderate to high severity. EPSS is not available, so the exact exploitation probability is unknown, and the vulnerability is not listed in CISA KEV. Exploitation is likely to occur in a Kubernetes environment where an attacker or a compromised user can create or modify Ingress resources. By declaring a path on the same host without matching auth-tls settings, the attacker forces Traefik to ignore mTLS, enabling unauthenticated traffic to the backend. No direct remote exploit from outside the cluster is documented, but any entity that can alter Ingress definitions faces the risk.