{"id":"CVE-2025-66491","revision":"0c088f502a294ddfb92404137f6227f8","records":[{"revision":"0c088f502a294ddfb92404137f6227f8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-66491","aliases":[],"title":"Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider","description":"Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to \"on\" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.","state":0,"publishedAt":"2025-12-09T00:38:39.208+00:00","modifiedAt":"2025-12-09T16:03:28.511+00:00","affected":[{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 3.5.0, < 3.6.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj","https://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4","https://github.com/traefik/traefik/releases/tag/v3.6.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-66491","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-66491","identifiers":["CVE-2025-66491"]},"retained":false,"historicalAffected":[]}],"coverage":[]}