CVE-2026-85596

Executive Summary

CVE-2026-85596 is a critical (CVSS 9.8) authentication bypass affecting Traefik versions 3.7.0 through 3.7.10 when operating as a Kubernetes Ingress controller via the NGINX Ingress provider. A naming collision in the TLS option generated for Ingress objects carrying mutual-TLS client-authentication annotations causes Traefik to detect a TLS options conflict and fall back to the entry point's default TLS configuration — which does not request a client certificate. As a result, any route explicitly configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable by unauthenticated attackers without presenting a client certificate, fully undermining the mTLS access-control boundary. Only the 3.7 release line is affected; v3.7.11 restores correct behavior.

Technical Analysis

Traefik's Kubernetes Ingress NGINX provider translates NGINX Ingress annotations into Traefik dynamic configuration primitives. Among these is the set of client-certificate authentication annotations:

• nginx.ingress.kubernetes.io/auth-tls-secret — references the Kubernetes Secret containing the CA used to validate client certificates.
• nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" — instructs the proxy to require and verify a client certificate.

When processing an Ingress that carries these annotations, Traefik synthesizes a TLS option object and names it after the Ingress object's namespace and name. This design assumption breaks when two Ingress objects share the same host, the same client CA Secret, and the same client-authentication mode: because each Ingress produces a TLS option named after its own namespace/name, the same host ends up associated with two distinct TLS option names.

Traefik treats a host mapped to two conflicting TLS option definitions as an invalid configuration for that host and, rather than applying either client-auth TLS option, falls back to the entry point's default TLS configuration. The default TLS configuration does not request a client certificate during the handshake.

The security consequence is the core of this CVE: a route whose Ingress explicitly declares auth-tls-verify-client: "on" — meaning the operator's clear intent is to require mutual TLS — is served under a TLS configuration that performs no client-certificate request or verification. The mTLS gate that was supposed to front the route is silently dropped. Any client that reaches the host over TLS is treated as unauthenticated-but-allowed, enabling full unauthenticated access to whatever workloads the affected route exposes.

This maps to CWE-287 (Improper Authentication). The vulnerability is a configuration-resolution flaw: a collision in internally generated identifiers results in Traefik degrading to a weaker security posture (fail-open) instead of failing closed. The CVSS vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflects network reachability, no privileges, no user interaction, and full loss of confidentiality, integrity, and availability on the affected route.

Attack surface: any Traefik 3.7.x deployment acting as a Kubernetes Ingress controller using the NGINX Ingress provider, with at least two Ingress objects targeting the same host and sharing a client CA secret plus a common client-auth mode. Public PoC is reported; no CISA KEV listing and no confirmed in-the-wild exploitation at the time of writing.

Exploitation Scenarios

No public exploit code has been independently confirmed; the attack chain below is derived strictly from the documented vulnerability mechanics (CWE-287, config-collision-triggered fail-open).

1. Reconnaissance / target identification. The attacker identifies an externally reachable Traefik 3.7.0–3.7.10 endpoint hosting a Kubernetes Ingress protected by mTLS client authentication. Fingerprinting of Traefik edge instances, host enumeration, and observation of which routes return 403/TLS-handshake failures (client cert required) versus normal responses helps locate a candidate host. Because the flaw requires two Ingress objects sharing a host, a client CA secret, and client-auth mode, hosts with overlapping Ingress definitions are the highest-value targets.

2. Triggering the flaw class. The attacker does not need any special priming in the common case: once the colliding Ingress definitions exist, Traefik has already resolved the host to the entry point's default TLS configuration. The condition that would normally enforce a client-certificate request is not active for that host. The attacker simply initiates a standard TLS connection to the host — the server does not request a client certificate, and the connection proceeds as an ordinary unauthenticated TLS session.

3. Access / execution at the vulnerability-class level. With the handshake completed without a client certificate, the attacker sends an ordinary HTTP request to the route that was intended to be mTLS-gated (e.g., an administrative, partner-only, or internal API path). The request is accepted because the client-authentication requirement was dropped. No credentials, tokens, or certificate material are required.

4. Post-exploitation impact. The attacker gains unauthenticated access to whatever the affected route exposes. Depending on the workload, this may include sensitive APIs, internal tooling, or administrative functions — consistent with the CVSS C:H/I:H/A:H impact. From there, standard post-exploitation applies: enumerating exposed data, invoking privileged operations, and pivoting to downstream services the route is authorized to reach. Because the bypass is silent and produces normal-looking successful requests, it may not be evident in application logs unless TLS client-cert enforcement is independently monitored.

Note: exact request shapes, endpoint paths, and header values cannot be enumerated from the advisory; any specific path belongs to the protected application, not to Traefik itself.

Impact Assessment

• Confidentiality (High): routes intended to be restricted to holders of a valid client certificate become readable by any network client.
• Integrity (High): the same unauthenticated clients can typically invoke write operations the protected route exposes.
• Availability (High): the affected route remains reachable and performant, but the loss of the access-control boundary permits disruptive or abusive use.
• Scope (Unchanged): the failure is confined to the affected host's TLS option resolution.
• Business blast radius: mTLS is commonly the sole authentication control for machine-to-machine, B2B/partner, and internal-service boundaries. Any organization running Traefik 3.7.0–3.7.10 as an Ingress controller with NGINX-annotation-based client-auth is exposed wherever Ingress collisions occur. Because the collapse is triggered by an in-cluster configuration condition (duplicate host + shared CA secret + same auth mode), some operators may be affected without realizing their TLS option naming has collided. Affected systems include externally published APIs, admin panels, and interservice endpoints fronted by the affected host. EPSS is low (0.00224, ~13.2 percentile), and CISA KEV does not list this CVE, indicating limited observed exploitation — but the absence of mass exploitation today does not reduce the severity for exposed, mTLS-only protected hosts.

Detection Guidance

Sigma Rule

title: Traefik Kubernetes Ingress Client TLS Auth Bypass - Access Without Client Certificate
id: 8f2a1c74-3b6d-4e91-9a2c-traefik85596
status: experimental
description: Detects successful HTTP access to mTLS-protected routes on Traefik without a verified client certificate, consistent with CVE-2026-85596.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85596
author: Threat Intelligence - valtersit.com
date: 2026/01/01
logsource:
  category: reverse_proxy
  product: traefik
detection:
  selection_method:
    - http.request.method|contains:
        - GET
        - POST
        - PUT
        - DELETE
        - PATCH
  selection_missing_client_cert:
    tls.client.subject: null
    tls.client_verified: false
  selection_route:
    router.name|contains: '-'
  condition: selection_method and selection_missing_client_cert and selection_route
fields:
  - client_ip
  - request_host
  - request_path
  - tls.client_verified
falsepositives:
  - Legitimate routes intentionally not requiring client certificates
level: high
tags:
  - attack.t1190
  - cve.2026.85596

YARA Rule

rule CVE_2026_85596_Traefik_TLS_Auth_Bypass
{
    meta:
        description = "Detects Traefik Kubernetes Ingress NGINX provider TLS option handling vulnerable to CVE-2026-85596 client-auth bypass"
        author = "Threat Intelligence - valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85596"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $ann1 = "nginx.ingress.kubernetes.io/auth-tls-secret" ascii wide
        $ann2 = "nginx.ingress.kubernetes.io/auth-tls-verify-client" ascii wide
        $tlsopt = "TLS option" ascii wide nocase
        $conflict = "conflict" ascii wide nocase
        $entrypoint = "entry point" ascii wide nocase
        $defaultcfg = "default" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        $ann1 and
        $ann2 and
        ($tlsopt or $conflict) and
        $entrypoint and
        $defaultcfg
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-85596 Traefik Kubernetes Ingress mTLS Client Auth Bypass - TLS connection without client certificate to protected host"; flow:to_server,established; tls.handshake.type:1; xbits:unset,traefik_client_cert; sid:202685596; rev:1; classtype:attempted-admin; reference:cve,2026-85596; metadata:service http, service tls;)

alert http any any -> any any (msg:"CVE-2026-85596 Traefik mTLS-protected route accessed without verified client certificate"; flow:to_server,established; http.host; content:"HTTP/"; xbits:isset,traefik_no_client_cert; sid:202685597; rev:1; classtype:attempted-admin; reference:cve,2026-85596; metadata:service http;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.action == "tls_client_hello" and tls.client.ja3 != null ]
  [ http where event.action == "request-received" and http.response.status_code >= 200 and
    tls.client.certificate == null and traefik.router.name : "*" ]

Splunk SPL Query

index=traefik sourcetype=traefik:access
| search router_name=* status>=200
| eval has_client_cert=if(isnull(tls_client_subject) OR tls_client_subject="", 0, 1)
| search has_client_cert=0
| where like(router_name, "%-%")
| stats count values(request_host) as hosts values(request_path) as paths by client_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="traefik,cve-2026-85596">
  <rule id="100596" level="12">
    <decoded_as>json</decoded_as>
    <field name="router_name">\.</field>
    <field name="status">2\d\d</field>
    <field name="tls_client_verified">false</field>
    <description>CVE-2026-85596: Access to mTLS-protected Traefik route without verified client certificate</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>

  <rule id="100597" level="10">
    <if_sid>100596</if_sid>
    <field name="request_path">admin|internal|api</field>
    <description>CVE-2026-85596: Sensitive route accessed without client certificate authentication</description>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) claims the issue is fixed in v3.7.11; this has not been independently confirmed against the vendor changelog or commit history. Treat as provisional and verify before relying on it.

1) Immediate mitigations (until patch is verified):

• Remove the collision condition. Audit all Ingress objects for duplicate host values combined with the same auth-tls-secret and identical auth-tls-verify-client mode. Ensure no two Ingresses on the same host share the relevant TLS parameters, which prevents Traefik from resolving the host to the default TLS configuration.
• Fail closed at a second layer. Do not rely solely on Traefik mTLS annotations for authorization. Enforce authentication at the application/service layer and via network policy (e.g., Kubernetes NetworkPolicy, service mesh mTLS) so that a dropped client-certificate requirement does not grant access.
• Restrict network reachability of mTLS-protected hosts to expected client source ranges as defense-in-depth.
• Monitor for successful requests to mTLS-protected routes that lack a verified client certificate (see detection rules above).

2) Patch / upgrade steps:

• Upgrade Traefik to v3.7.11 (per NVD). Confirm the fix in the vendor's release notes and validate in a staging cluster with the same Ingress topology, including deliberate duplicate-host/colliding-TLS-option configurations, before production rollout.
• After upgrade, verify that Ingress objects declaring auth-tls-verify-client: "on" again require a client certificate and that TLS option conflicts no longer force fallback to the entry point default.

3) Long-term hardening:

• Adopt a configuration-validation policy that rejects colliding Ingress definitions (same host + same TLS/auth options) at admission time (e.g., via validating admission policies).
• Define mTLS-protected routes consistently per host to avoid divergent TLS option generation.
• Maintain layered authentication (proxy + application) so any single control failure does not result in unauthenticated access.
• Track Traefik 3.7.x security advisories and pin to patched releases.

References

1. NVD — CVE-2026-85596: https://nvd.nist.gov/vuln/detail/CVE-2026-85596
2. Traefik release notes / changelog (verify v3.7.11 fix): https://github.com/traefik/traefik/releases
3. Traefik Kubernetes Ingress NGINX provider documentation (auth-tls annotations): https://doc.traefik.io/traefik/providers/kubernetes-ingress/
4. Traefik security advisories: https://github.com/traefik/traefik/security/advisories
5. CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html

Exploitation status: Public PoC reported by available intelligence; no CISA KEV listing and no confirmed active exploitation campaigns identified. EPSS 0.00224 (~13.2 percentile). Vendor fix claimed in v3.7.11 (single-source, unconfirmed). No named threat actor activity attributable to this CVE at time of writing.