CVE-2026-114638
Description
A flaw was found in Traefik. When using the Kubernetes Ingress NGINX provider, client certificate authority (CA) secret names can collide and be incorrectly merged during name normalization. A remote attacker holding a certificate issued for a different service can exploit this flaw to bypass authentication and gain unauthorized access to protected hosts, while legitimate clients may be denied access.
Statement
Red Hat has evaluated this vulnerability as having an Important severity because successful exploitation allows an untrusted remote client holding a certificate from an unrelated service to circumvent mutual TLS controls and access restricted endpoints. This risk manifests when the Kubernetes Ingress NGINX provider transforms secret identifiers using dot-to-dash substitution, resulting in name collisions that combine distinct trust anchors. Default Red Hat platforms such as Red Hat Enterprise Linux and OpenShift Container Platform do not distribute Traefik, meaning standard environments are unaffected unless third-party or standalone Traefik deployments are utilized.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
