CVE-2026-114638

8.7 HIGHpublic exploit available

Published 2026-10-22 · Updated 2026-10-23

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own client CA, while that host's legitimate clients are refused.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weaknesses

CWE-287

Public exploit & PoC references

https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw

All references

https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw
https://www.vulncheck.com/advisories/traefik-3.7.0-before-3.7.14-client-ca-mix-up-via-auth-tls-secret-name-collision

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2025-43936
MEDIUMCVE-2026-100143
HIGHCVE-2026-100163
UNSCOREDCVE-2026-100169PoC
HIGHCVE-2026-100606PoC
HIGHCVE-2026-100607PoC
HIGHCVE-2026-100684PoC
HIGHCVE-2026-100709PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.