Most recent entries from all

certfr-2025-avi-1077 — De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer une élévatio…

2026-10-04T04:56:29.110688+00:00

certfr-2025-avi-1077

EUVD-2026-262944

2026-10-04T04:56:29.110723+00:00

EUVD-2026-262944

fkie_cve-2025-66491

2026-10-04T04:56:29.110738+00:00

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.

GHSA-7vww-mvcr-x6vj — Traefik Inverted TLS Verification Logic in ingress-nginx Provider

2026-10-04T04:56:29.110766+00:00

Affected: Go: github.com/traefik/traefik/v3

## Impact

There is a potential vulnerability in Traefik NGINX provider managing the `nginx.ingress.kubernetes.io/proxy-ssl-verify` annotation.

The provider inverts the semantics of the `nginx.ingress.kubernetes.io/proxy-ssl-verify` annotation. Setting the annotation to `"on"` (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.6.3

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

Original Description

### Summary

A logic error in Traefik's experimental ingress-nginx provider inverts the semantics of the `nginx.ingress.kubernetes.io/proxy-ssl-verify` annotation. Setting the annotation to `"on"` (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected.

### Details

In `pkg/provider/kubernetes/ingress-nginx/kubernetes.go` at line 512, the `InsecureSkipVerify` field is set using inverted logic:

```go nst := &namedServersTransport{ Name: provider.Normalize(namespace + "-" + name), ServersTransport: &dynamic.ServersTransport{ ServerName: ptr.Deref(cfg.ProxySSLName, ptr.Deref(cfg.ProxySSLSe…

openSUSE-SU-2026:10020-1 — traefik-3.6.6-1.1 on GA media

2026-10-04T04:56:29.110821+00:00

traefik-3.6.6-1.1 on GA media