Traefik versions from 3.7.0 through 3.7.10 contain a flaw in the Kubernetes Ingress NGINX provider that allows an attacker to bypass TLS client authentication. When an Ingress uses the nginx.ingress.kubernetes.io/auth-tls-secret annotation, Traefik generates a TLS option name based on the Ingress namespace and name. If two Ingress resources share the same host, the same client‑CA secret, and the same client‑authentication mode, the resulting TLS option names conflict, causing Traefik to ignore the configured TLS client verification and fall back to the entry point’s default TLS configuration, which does not request a client certificate. The result is that routes protected with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" become reachable without a client certificate. This vulnerability is classified as CWE-287 (Authentication Bypass) and CWE-305.

The flaw affects Traefik Inc.’s Traefik product in the v3.7 series, specifically any installation using Traefik as the Kubernetes Ingress NGINX provider and configured with the nginx-tls-secret annotation. Only the v3.7 line is affected; versions 3.7.11 and later contain the fix. Systems that create Ingress objects which share a host, client‑CA secret, and client‑authentication mode are impacted.

The CVSS base score of 8.2 classifies this issue as high severity, while the EPSS score of less than 1% indicates that exploitation has not been observed widely and the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. If an attacker has permission to create or modify Ingress resources in a Kubernetes cluster, they can craft two conflicting Ingress objects that share the host, client‑CA secret, and authentication mode, triggering the TLS option conflict and enabling unauthorized access to protected routes. Thus, the attack vector is internal to the cluster and the Kubernetes API server.