Traefik Inverted TLS Verification Vulnerability in NGINX Ingress Provider Allowing Man-in-the-Middle Attacks

A vulnerability exists in Traefik versions 3.5.0 through 3.6.2 within the NGINX ingress Kubernetes provider. The issue arises from inverted TLS verification logic related to the 'nginx.ingress.kubernetes.io/proxy-ssl-verify' annotation. When the annotation is set to 'on', it disables backend TLS certificate verification, contrary to the intended effect. This misconfiguration can lead to man-in-the-middle attacks against HTTPS backends, as operators may mistakenly believe they are enforcing proper certificate validation.

Impact

Exploitation of this vulnerability allows for man-in-the-middle attacks against HTTPS backends, undermining the integrity of TLS verification and potentially leading to unauthorized interception or modification of data.

Remediation

Users can upgrade to Traefik version 3.6.3, where this vulnerability has been patched.