CVE-2026-114640
Description
A flaw was found in Traefik. When plaintext routing is used and client certificate forwarding is enabled without enforcing secure redirection, the Ingress-NGINX provider forwards client-provided SSL headers directly to upstream backend services. An unauthenticated remote attacker can exploit this vulnerability by sending forged headers, resulting in an authentication bypass and allowing them to impersonate mutual Transport Layer Security (mTLS) identities.
Statement
Red Hat has classified this vulnerability as having an Important severity impact because unauthenticated remote adversaries can bypass authentication barriers and spoof mutual TLS identities to gain unauthorized access to protected upstream backend services. The flaw only manifests under specific, non-standard configurations where unencrypted HTTP traffic routing is permitted concurrently with upstream client certificate header forwarding. Because Traefik is not packaged, supported, or distributed within Red Hat products, supported enterprise platforms such as Red Hat Enterprise Linux and OpenShift Container Platform are not directly exposed.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
