CVE-2025-66491: Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider
Vulnerability summary
CVE-2025-66491 is a medium (CVSS 5.9) Improper Certificate Validation vulnerability in traefik. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.7% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 4Timeline
- 09-12-2025PublishedVulnerability first disclosed.
- 09-12-2025Last modifiedVulnerability information updated.
Description
Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.22% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard3 products
- traefik-3.5All versions (No fix recorded)
- traefik-fips-2.11< 2.11.51-r0
- traefik-fips-3.5All versions (No fix recorded)
Github.com/traefik/traefik2 products
- v2All versions (No fix recorded)
- v3≥ 3.5.0, < 3.6.3
Github.com/traefik1 product
- traefikAll versions (No fix recorded)
Traefik1 product
- traefik≥ 3.5.0, < 3.6.3
4 vendors · 7 products
References
6 links- github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vjX Refsource CONFIRMWEBAdvisoryPatchVendor Advisory
- github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4X Refsource MISCWEBFIXPatch
- github.com/traefik/traefikPACKAGE