CVE-2026-114640

HighCVSS 8.7/10Last modified Oct 22, 2026

Description

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
traefiktraefik>= 3.7.0, < 3.7.14

References

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1146413.7Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, whereCVE-2026-1146428.7Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed bCVE-2026-1146435.4The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type aCVE-2026-1146445.9The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON valuCVE-2026-1146455.2A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to CVE-2026-1146466.5A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a CVE-2026-1146474.3The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlikCVE-2026-1146487.6The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINCVE-2026-1146496.8The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached cCVE-2026-114653.1A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the filCVE-2026-1146505.9A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption CVE-2026-1146514.0A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed