CVE-2026-119572
Description
A flaw was found in Traefik. When processing Kubernetes Ingress resources through the NGINX provider, conflicting path definitions on the same host can cause Traefik to silently disable mutual Transport Layer Security (mTLS) authentication. As a result, Traefik falls back to default TLS settings, allowing an unauthenticated remote attacker to access protected backend services that require client certificate authentication.
Statement
This vulnerability is rated Important because an unauthenticated remote attacker can circumvent mutual TLS authentication to access protected backends, although exploitation depends on contradictory ingress path rules on a shared hostname. Traefik is not provided or utilized in Red Hat Enterprise Linux or Red Hat OpenShift, which utilize OpenShift Ingress for cluster traffic routing. Therefore, default Red Hat product deployments are not affected by this flaw.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
