Traefik versions from 3.7.0 through 3.7.10 contain a fault in the Kubernetes Ingress NGINX provider. When an Ingress carries the nginx.ingress.kubernetes.io/auth-tls-secret annotation, Traefik creates a TLS option named after the Ingress namespace and name. If two Ingress objects share the same host, the same client CA secret, and the same client‑authentication mode, the resulting TLS option names conflict and cause Traefik to fall back to the entry point’s default TLS configuration, which does not request a client certificate. Consequently, a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. The flaw is a form of authentication safety failure and is identified as CWE‑287.

Traefik Inc. Traefik product, versions 3.7.0 to 3.7.10, when deployed as the Kubernetes Ingress NGINX provider. Systems using Ingress objects that configure TLS client authentication with the nginx.ingress.kubernetes.io/auth-tls-secret annotation are impacted.

The CVSS base score of 8.2 classifies this vulnerability as high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. In practice, any user or application with permission to create or modify Ingress resources in a Kubernetes cluster can craft two conflicting Ingress objects that share a host, client CA secret, and authentication mode. The TLS option conflict would cause Traefik to revert to the default TLS configuration, effectively disabling client‑certificate verification for the host. The attack vector is feasible within typical Kubernetes administrative access and can result in unauthorized access to protected routes.