---
id: CVE-2026-119573
title: >-
  Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via
  auth-tls-secret
summary: >-
  Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the
  Kubernetes Ingress NGINX provider that skips the cross-namespace check on the
  auth-tls-secret annotation when a cached client authentication TLS option is
  reused. Users…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: traefik
product: traefik
affected:
  - traefik >= 3.7.11 < 3.7.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:12.918975Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:53:49.154Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119573'
references:
  - url: 'https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj'
    label: GitHub Security Advisory (GHSA-28hp-c82p-8vqj)
  - url: >-
      https://www.vulncheck.com/advisories/traefik-3.7.11-before-3.7.15-cross-namespace-authorization-bypass-via-auth-tls-secret
    label: >-
      VulnCheck Advisory: Traefik 3.7.11 before 3.7.15 Cross-Namespace
      Authorization Bypass via auth-tls-secret
tags:
  - cve.org
epss: 0.00261
epssPercentile: 0.1804
ingestedAt: '2026-11-05T16:07:30.518Z'
---

## Overview

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.

## Affected

- `traefik >= 3.7.11 < 3.7.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.