{"id":"EUVD-2025-201730","enisaUuid":"e51a5e88-e480-3d24-abc0-6c5b3b445b28","description":"Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to \"on\" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.","datePublished":"Dec 9, 2025, 12:38:39 AM","dateUpdated":"Dec 9, 2025, 4:03:28 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj\nhttps://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4\nhttps://github.com/traefik/traefik/releases/tag/v3.6.3\n","aliases":"CVE-2025-66491\nGHSA-7vww-mvcr-x6vj\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"5c0377f6-cf96-3db8-a957-3c63a11645d5","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.5.0, \u003c 3.6.3"}],"enisaIdVendor":[{"id":"9051486b-7690-36b3-900a-1db86b1939c2","vendor":{"name":"traefik"}}],"enisaIdVulnerability":[{"id":"2082b8d0-a235-31d4-8cf2-b6afe5476225","vulnerability":{"id":"CVE-2025-66491","description":"Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to \"on\" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.","datePublished":"Dec 9, 2025, 12:38:39 AM","dateUpdated":"Dec 9, 2025, 4:03:28 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj\nhttps://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4\nhttps://github.com/traefik/traefik/releases/tag/v3.6.3\n","enisa_id":"EUVD-2025-201730\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 6, 2026, 7:21:48 AM","vulnerabilityProduct":[{"id":"f64be1bc-4e7c-32b8-b1de-f38b0640b33e","product":{"name":"traefik","vendor":{"name":"traefik"}},"product_version":"3.5.0, \u003c 3.6.3"}],"vulnerabilityVendor":[{"id":"e79a42a5-a315-3030-9e92-31b63fcf7f96","vendor":{"name":"traefik"}}]}},{"id":"3409b5e0-316c-3680-b63c-ce89aaf7db15","vulnerability":{"id":"GHSA-7vww-mvcr-x6vj","description":"Traefik Inverted TLS Verification Logic in ingress-nginx Provider","datePublished":"Dec 8, 2025, 4:43:06 PM","dateUpdated":"Dec 9, 2025, 4:32:29 PM","baseScore":0.0,"references":"https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66491\nhttps://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4\nhttps://github.com/traefik/traefik\nhttps://github.com/traefik/traefik/releases/tag/v3.6.3\n","enisa_id":"EUVD-2025-201730\n","aliases":"CVE-2025-66491\nGHSA-7vww-mvcr-x6vj\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"c5f9ce65-2e05-37fa-b7c4-16103806fba9","advisory":{"id":"openSUSE-SU-2026:10020-1","description":"traefik-3.6.6-1.1 on GA media","summary":"traefik-3.6.6-1.1 on GA media","datePublished":"Jan 8, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 4:50:09 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10020-1.json\nhttps://www.suse.com/security/cve/CVE-2025-66490/\nhttps://www.suse.com/security/cve/CVE-2025-66491/\n","aliases":"CVE-2025-66490\nCVE-2025-66491\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"059905e3-e965-3473-b60e-e4f9e451541a","product":{"name":"traefik-0:3.6.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"0b00b0df-a2ed-3886-b1a7-12fa6beddcd0","product":{"name":"traefik-0:3.6.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"39c5472e-be6a-383c-a201-0dfa7b6a687d","product":{"name":"traefik-0:3.6.6-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"528703f5-c195-37de-96dd-0baf2022eeb4","product":{"name":"traefik-3.6.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6ff2ac51-22db-3c4c-bc7d-32c2078a57d6","product":{"name":"traefik-3.6.6-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a8001a04-5be0-37dd-8484-f696f9bbcf54","product":{"name":"traefik-0:3.6.6-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"dacadb99-8c28-3f38-a9cd-eca44fdb2192","product":{"name":"traefik-3.6.6-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"f98d5bc4-fcc4-3e1b-975f-bd823a929bdd","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"fe82c38f-1b45-3928-9c5c-8e40fa3a2568","product":{"name":"traefik-3.6.6-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}