CVE-2025-66491 - CVE House
Back to Database
Status published Medium CVE-2025-66491

Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider

Vulnerability Description

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66491

Credits & Attribution

No credits recorded in the NVD database.

References

More from traefik

View All →
CVE-2025-66490
Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules
Medium 6.9
CVE-2025-54386
Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution
High 7.3
CVE-2025-47952
Traefik allows path traversal using url encoding
Low 2.9
CVE-2025-32431
Traefik has a possible vulnerability with the path matchers
High 8.8
CVE-2024-52003
X-Forwarded-Prefix Header still allows for Open Redirect in traefik
Medium 6.3

Affected Vendor

Affected Software

traefik
Vulnerable Versions:
>= 3.5.0, < 3.6.3

Timeline

Official Publish: December 9th, 2025
Last Modified: December 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-295

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1040 Network Sniffing
Collection
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact