What’s Vulnerable › Vulnerabilities

CVE-2025-66491: Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-09 · updated 2026-10-14
• Weakness: CWE-295

Description

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.

Affected products

• Traefik: from 3.5.0 before 3.6.3 — fixed in 3.6.3

How to fix

Upgrade to a fixed version: Traefik 3.6.3. Check the vendor advisory for mitigations.

References

• https://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4
• https://github.com/traefik/traefik/releases/tag/v3.6.3
• https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj

Get alerted when CVE-2025-66491 or the next vulnerability affects your stack