{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "traefik: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/traefik--traefik/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/traefik--traefik/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114656/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114656/",
   "title": "CVE-2026-114656 disclosed",
   "content_text": "Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.",
   "date_published": "2026-10-22T01:43:42Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114642/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114642/",
   "title": "CVE-2026-114642 disclosed",
   "content_text": "Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.",
   "date_published": "2026-10-22T01:43:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114640/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114640/",
   "title": "CVE-2026-114640 disclosed",
   "content_text": "Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.",
   "date_published": "2026-10-22T01:43:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114639/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114639/",
   "title": "CVE-2026-114639 disclosed",
   "content_text": "Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.",
   "date_published": "2026-10-22T01:43:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114638/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114638/",
   "title": "CVE-2026-114638 disclosed",
   "content_text": "Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.",
   "date_published": "2026-10-22T01:43:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114637/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114637/",
   "title": "CVE-2026-114637 disclosed",
   "content_text": "Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.",
   "date_published": "2026-10-22T01:43:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114636/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114636/",
   "title": "CVE-2026-114636 disclosed",
   "content_text": "Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with the Ingress host can access backends protected by auth-type, auth-url, or whitelist-source-range annotations, with nothing logged.",
   "date_published": "2026-10-22T01:43:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114635/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114635/",
   "title": "CVE-2026-114635 disclosed",
   "content_text": "Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.",
   "date_published": "2026-10-22T01:43:36Z"
  }
 ]
}