Traefik versions 3.7.11 through 3.7.14 contain a flaw in the Kubernetes Ingress NGINX provider that ignores the cross‑namespace check for the auth‑tls‑secret annotation when a cached client authentication TLS option is reused. This flaw, categorized as CWE‑863, allows an attacker who can create or edit Ingress resources in one namespace to reference a CA secret located in a different namespace. The secret is then enforced on the attacker’s routes, revealing its existence without exposing its contents, effectively bypassing the intended isolation between namespaces.

Traefik 3.7.11 to 3.7.14 are affected. Administrators running Traefik in Kubernetes clusters who permit users to create or modify Ingress objects with the auth‑tls‑secret annotation are impacted. The vulnerability specifically targets the Kubernetes Ingress NGINX provider implementation within these releases.

The CVSS score of 2.1 signals low overall severity, and the EPSS score is not available, indicating no publicly reported exploitation rates. The vulnerability is not listed in CISA's KEV catalog, suggesting it is not a known target of widespread exploitation. Based on the description, it is inferred that the attack requires the ability to create Ingress objects and that a cached TLS authentication option must already exist. Although the impact is limited to confirming the presence of a secret, an attacker could leverage this information to conduct further reconnaissance or privilege escalation within a Kubernetes environment.