Summary
Traefik's Kubernetes Ingress NGINX provider can silently stop enforcing mutual TLS when another Ingress on the same host lacks matching client-certificate settings. In that configuration, an unauthenticated attacker may reach a backend that expects client certificates.
Traefik's Kubernetes Ingress NGINX provider can silently stop enforcing mutual TLS when another Ingress on the same host lacks matching client-certificate settings. In that configuration, an unauthenticated attacker may reach a backend that expects client certificates.
Affected context
The issue can occur in Traefik deployments using the Kubernetes Ingress NGINX provider with mTLS configured through the auth-tls-secret annotation. Risk increases when multiple Ingress resources share a host and their authentication-related TLS settings are inconsistent, allowing default TLS options to be selected instead of the intended client-certificate requirements.
The issue can occur in Traefik deployments using the Kubernetes Ingress NGINX provider with mTLS configured through the auth-tls-secret annotation. Risk increases when multiple Ingress resources share a host and their authentication-related TLS settings are inconsistent, allowing default TLS options to be selected instead of the intended client-certificate requirements.
Exploit preconditions
- Attack surface: Network-accessible HTTP or HTTPS routes exposed through Traefik
- Required access: No valid client certificate is required if the affected route is reachable
- Trigger point: Routing configuration involving multiple Ingress resources on the same host
- Why exploitation is possible: A host-level configuration mismatch can cause Traefik to fall back to TLS options that do not enforce the configured mTLS requirement
- Attack surface: Network-accessible HTTP or HTTPS routes exposed through Traefik
- Required access: No valid client certificate is required if the affected route is reachable
- Trigger point: Routing configuration involving multiple Ingress resources on the same host
- Why exploitation is possible: A host-level configuration mismatch can cause Traefik to fall back to TLS options that do not enforce the configured mTLS requirement
Why this happens
The underlying issue is an authentication configuration-resolution flaw in the Kubernetes Ingress NGINX provider. When Ingress resources sharing a host do not express consistent auth-tls-secret settings, the provider may select default TLS behavior and omit client-certificate verification for a route that was expected to require it. This maps to CWE-287: Improper Authentication, because the system fails to enforce the intended authentication factor before granting access to a protected backend.
The underlying issue is an authentication configuration-resolution flaw in the Kubernetes Ingress NGINX provider. When Ingress resources sharing a host do not express consistent auth-tls-secret settings, the provider may select default TLS behavior and omit client-certificate verification for a route that was expected to require it. This maps to CWE-287: Improper Authentication, because the system fails to enforce the intended authentication factor before granting access to a protected backend.
Potential impact
- Unauthenticated users may access protected application endpoints
- Attackers could retrieve or modify data exposed by the backend
- Authorization boundaries based on client certificates may be bypassed
- Affected services could experience privacy, integrity, or availability consequences
- Unauthenticated users may access protected application endpoints
- Attackers could retrieve or modify data exposed by the backend
- Authorization boundaries based on client certificates may be bypassed
- Affected services could experience privacy, integrity, or availability consequences
General mitigation guidance
Mitigation generally focuses on making authentication requirements explicit, consistent, and fail-closed across all routes sharing a host.
Common defensive patterns include:
- Apply consistent mTLS and
auth-tls-secretsettings to every Ingress associated with a shared host - Prefer explicit, narrowly scoped TLS and authentication configuration over provider defaults
- Use deny-by-default behavior when authentication settings are missing or ambiguous
- Separate protected and unprotected applications across distinct hostnames where practical
- Restrict backend privileges and sensitive operations so an authentication control failure has limited consequences
- Validate rendered routing configuration in CI and deployment policy checks before it reaches production
Mitigation generally focuses on making authentication requirements explicit, consistent, and fail-closed across all routes sharing a host.
Common defensive patterns include:
- Apply consistent mTLS and
auth-tls-secretsettings to every Ingress associated with a shared host - Prefer explicit, narrowly scoped TLS and authentication configuration over provider defaults
- Use deny-by-default behavior when authentication settings are missing or ambiguous
- Separate protected and unprotected applications across distinct hostnames where practical
- Restrict backend privileges and sensitive operations so an authentication control failure has limited consequences
- Validate rendered routing configuration in CI and deployment policy checks before it reaches production
How teams detect issues like this
Organizations can look for this class of issue through:
- Configuration analysis that identifies shared hosts with inconsistent mTLS or
auth-tls-secretsettings - Code and provider reviews focused on default TLS-option selection and fail-open authentication behavior
- Integration tests that access protected routes without client certificates and verify rejection
- Runtime monitoring for successful requests to mTLS-protected backends without certificate evidence
- Policy enforcement requiring explicit authentication settings for sensitive Ingress resources
- Automated configuration scanners or admission controls that compare related Ingress resources before deployment
Organizations can look for this class of issue through:
- Configuration analysis that identifies shared hosts with inconsistent mTLS or
auth-tls-secretsettings - Code and provider reviews focused on default TLS-option selection and fail-open authentication behavior
- Integration tests that access protected routes without client certificates and verify rejection
- Runtime monitoring for successful requests to mTLS-protected backends without certificate evidence
- Policy enforcement requiring explicit authentication settings for sensitive Ingress resources
- Automated configuration scanners or admission controls that compare related Ingress resources before deployment
