CVE-2025-66491

MEDIUM5.9

Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider

Published Dec 9, 2025

Modified 1 months ago

No fix available

Details

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.

References

WEBhttps://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4 WEBhttps://github.com/traefik/traefik/releases/tag/v3.6.3 WEBhttps://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-66491

CVSS Analysis

CVSS v3.1

5.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

5.9/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

Cryptography

CWE-295

Improper Certificate Validation

Ecosystems

Timeline

PublishedDec 9, 2025

ModifiedDec 9, 2025