CVE-2026-85596 is a client certificate bypass in the Traefik Kubernetes Ingress NGINX provider, versions v3.7.0 to v3.7.10 (CVSS 9.8, critical). Two Ingresses on one host caused a TLS option conflict. Upgrade to v3.7.11. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The advisory lists Traefik v3.7.0 through v3.7.10, patched in v3.7.11. The weakness is CWE-287, improper authentication. Only the v3.7 line is affected, since the Ingress NGINX provider's client authentication handling arrived in v3.7.0.
The TLS option for an Ingress with the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. Two Ingresses with the same host, CA secret and client authentication mode produced two option names. Traefik saw a conflict and fell back to the default TLS configuration, which does not ask for a client certificate. A route set to require one became reachable without it. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check whether you use the Ingress NGINX provider with client certificate annotations.
kubectl get ingress -A -o yaml | grep -n "auth-tls"
Look for several Ingresses that share a host. Then check the Traefik image version. A host with duplicate mTLS Ingresses on v3.7.0 to v3.7.10 should be treated as open.
What to do now
- Upgrade Traefik to v3.7.11 or later.
- List hosts with more than one Ingress using auth-tls annotations.
- Add an application level check on backends that rely only on the proxy for client identity.
- Review access logs for requests on mTLS hosts without a client certificate.
- Retest the mTLS requirement from a client with no certificate after upgrading.
Why it matters
The generated option name was built from the Ingress identity, not from the policy it expressed. Identical policies therefore looked different, and the conflict handler chose the weaker default.
The broader lesson is to fail closed. When a proxy cannot resolve a security setting, refusing the connection is safer than reverting to a default that skips the control.
Quick check
Does Traefik v2 have this problem?
The advisory says only the v3.7 line is affected, because the provider feature started in v3.7.0.
Sources
Last reviewed: 19 October 2026.
