{"id":"CVE-2025-66491","title":"Traefik is an HTTP reverse proxy and load balancer","summary":"Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to \"on\" (intending to enable bac…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-295"],"vendor":"traefik","product":"traefik","affected":["traefik >= 3.5.0, < 3.6.3"],"patched":["traefik 3.6.3"],"published":"2025-12-09","updated":"2026-10-14","sourceUpdated":"2026-10-14T22:10:00.210","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66491","references":[{"url":"https://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4","label":"security-advisories@github.com"},{"url":"https://github.com/traefik/traefik/releases/tag/v3.6.3","label":"security-advisories@github.com"},{"url":"https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66491"},{"url":"https://github.com/traefik/traefik"}],"tags":["nvd","osv","go"],"epss":0.00221,"epssPercentile":0.12554,"aliases":["GHSA-7vww-mvcr-x6vj","GO-2025-4205"],"ecosystem":"go","ingestedAt":"2026-09-12T03:13:01.765Z","slug":"CVE-2025-66491","body":"## Overview\n\nTraefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to \"on\" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.\n\n## Affected\n\n- `traefik >= 3.5.0, < 3.6.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `traefik 3.6.3`\n\n## Package advisory (CVE-2025-66491)\n\nAffected packages:\n\n- `github.com/traefik/traefik/v3 >= 3.5.0, < 3.6.3`\n\nPatched in:\n\n- `github.com/traefik/traefik/v3 3.6.3`\n\nSource: https://osv.dev/vulnerability/GHSA-7vww-mvcr-x6vj","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}