What is GHSA-wwwm-2fq8-c2gm?

GHSA-wwwm-2fq8-c2gm is a security advisory published by GitHub Security Advisories with High severity. Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its...

Which CVE IDs does GHSA-wwwm-2fq8-c2gm cover?

GHSA-wwwm-2fq8-c2gm covers the following CVE IDs: CVE-2026-114640. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wwwm-2fq8-c2gm?

GHSA-wwwm-2fq8-c2gm has a CVSS v3 base score of 8.7, published by GitHub Security Advisories.

GHSA-wwwm-2fq8-c2gmHighCVSS 8.7

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-114640 →

📋 Description

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.

🔗 References (4)

https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6
https://nvd.nist.gov/vuln/detail/CVE-2026-114640
https://www.vulncheck.com/advisories/traefik-3.7.0-before-3.7.14-mtls-header-spoofing-via-ingress-nginx-http-router
https://github.com/advisories/GHSA-wwwm-2fq8-c2gm