UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114638

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.

Severity
High 7.0
Published
22 Oct 2026
Last changed
27 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.7.14
Sources
NVD

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • From 3.7.0 before 3.7.14

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-114638
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114638