CVE-2026-114638 traefik CVE debrief

Who should care

Defenders responsible for Traefik deployments, especially those using the Kubernetes Ingress NGINX provider, should assess their exposure and prioritize patching or mitigation. This includes administrators and security teams managing Traefik instances in production environments.

Why it matters

CVE-2026-114638 is a high-severity vulnerability in Traefik that allows unauthorized access due to improper authentication in the Kubernetes Ingress NGINX provider. Defenders should prioritize patching or mitigating this issue, especially in environments using Traefik with Kubernetes Ingress NGINX provider. The vulnerability's impact includes potential unauthorized access, bypass of client CA authentication, and refusal of legitimate client access. Evidence is limited to official CVE and NVD records, vendor advisories, and third-party analyses.

• Potential unauthorized access to sensitive resources
• Bypass of client CA authentication for certain hosts
• Refusal of legitimate client access due to merged client CAs
• Need for verification of client CA configurations and Traefik versions

Technical summary

The vulnerability is caused by the improper handling of client CAs in Traefik's Kubernetes Ingress NGINX provider. When auth-tls-secret names collide after dot-to-dash normalization, client CAs are merged, allowing an attacker with a certificate from another host's CA to access a host requiring its own client CA, while legitimate clients of that host are refused access. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Traefik is used with Kubernetes Ingress NGINX provider. The priority is high due to the potential for unauthorized access. Evidence is limited to official CVE and NVD records, vendor advisories, and third-party analyses.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Traefik is used with Kubernetes Ingress NGINX provider. The priority is high due to the potential for unauthorized access.

Recommended defensive actions

• Patch Traefik to version 3.7.14 or later
• Review and update Kubernetes Ingress NGINX provider configurations to prevent auth-tls-secret name collisions
• Monitor for and restrict access to sensitive resources
• Verify client CA configurations for Traefik deployments
• Confirm whether affected Traefik deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The evidence for this vulnerability comes from the official CVE Program record and the NIST National Vulnerability Database. Additional information is provided by the Traefik vendor advisory and a third-party advisory from Vulncheck. The details are limited to the information provided in these sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.