CVE-2026-114640
|
| |
|
|
Software afectado |
KUBERNETES |
|
|
|
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-114640 |
