GHSA-ccgh-9g52-6vwg

There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider when several Ingresses share a host configured for client certificate authentication with the nginx.ingress.kubernetes.io/auth-tls-secret annotation. Since v3.7.15 the client authentication applies to the whole host and the TLS handshake uses the settings of the first Ingress declaring it, but the Ssl-Client-* headers were still built from the annotations of each Ingress: an Ingress with auth-tls-verify-client: on sharing a host with an Ingress using optional_no_ca forwarded Ssl-Client-Verify: SUCCESS, together with the subject and issuer chosen by the client, for a certificate that was never verified, and an Ingress without its own auth-tls-secret or without auth-tls-pass-certificate-to-upstream had no middleware handling these headers, so the values sent by the client reached the backend.