AIKIDO-2026-476431
github.com/traefik/traefik/v3 is vulnerable to Incorrect Authorization
21
CVE Score
Low
Incorrect Authorization
TL;DR
Traefik’s Kubernetes Ingress NGINX provider skipped the cross-namespace check when it reused a cached client-authentication TLS option, letting a user who could create Ingresses in one namespace use another namespace’s CA secret on their routes and learn whether it existed and was in use. This required allowCrossNamespaceResources to be disabled and the secret to have already been used by another Ingress; its contents were not disclosed. The fix is available in Traefik 3.7.15.
How do I fix this?
Upgrade the github.com/traefik/traefik/v3 package to 3.7.15 or later.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range of github.com/traefik/traefik/v3.
Versions
3.7.11 - 3.7.14
Fixed in 3.7.15Background info
github.com/traefik/traefik/v3 is vulnerable to Incorrect Authorization in versions 3.7.11 - 3.7.14.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.