CVE-2026-119573 Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

What is CVE-2026-119573?

CVE-2026-119573 is a low-severity vulnerability in Traefik, published on 30 Oct 2026.

Official description

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.

Weakness: CWE-863

Which versions are affected by CVE-2026-119573?

It affects 1 product.

Products include Traefik.

How do I fix CVE-2026-119573?

No fix has been published for CVE-2026-119573 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119573 being exploited?

There is no known exploitation of CVE-2026-119573 in the wild and no public exploit code.

Other vulnerabilities in Traefik

• CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik Critical 9.8
• CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect Critical 9.3
• CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth Critical 9.3
• CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse Critical 9.1
• CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging High 8.8

All Traefik vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-28hp-c82p-8vqj, GHSA-mvh9-fv5r-qhpj.