CVE-2026-85596 Traefik v3.7 Authentication Bypass via TLS Option Conflict
Attackers can bypass client certificate authentication in Traefik Kubernetes Ingress NGINX provider by triggering a TLS option conflict.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-85596?
CVE-2026-85596 is a high-severity authentication bypass vulnerability in Traefik Traefik, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress objects sharing the same host, the same client CA secret, and the same client-authentication mode produced two distinct TLS option names for that host. Traefik treats this as a TLS options conflict and falls back to the entry point's default TLS configuration, which does not request a client certificate, so a route configured with nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" becomes reachable without a client certificate. Only the v3.7 line is affected; the issue is fixed in v3.7.11.
Weakness: CWE-287
Which versions are affected by CVE-2026-85596?
It affects 1 product.
Products include Traefik Traefik.
How do I fix CVE-2026-85596?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-85596 being exploited?
There is no known exploitation of CVE-2026-85596 in the wild and no public exploit code.
Other vulnerabilities in Traefik Traefik
- CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Sources
Also known as GHSA-j994-9gqj-9hwq, GHSA-rgpg-cpwg-4f45, MINI-4h69-mw5j-fwr5, MINI-gp8c-vx46-fcqq.