{"id":"EUVD-2025-201730","revision":"cdf021d4eeff4a8997f5e4d24fe33766","records":[{"revision":"cdf021d4eeff4a8997f5e4d24fe33766","observedAt":"2026-10-27T23:53:37.073+00:00","statement":{"source":"euvd","id":"EUVD-2025-201730","aliases":["CVE-2025-66491","GHSA-7vww-mvcr-x6vj"],"title":"Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to \"on\" (intending to enable backen…","description":"Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to \"on\" (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected. This issue is fixed in version 3.6.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9,"severity":null}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj","https://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4","https://github.com/traefik/traefik/releases/tag/v3.6.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201730","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 9, 2025, 12:38:39 AM","dateUpdated":"Dec 9, 2025, 4:03:28 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:10020-1","title":"traefik-3.6.6-1.1 on GA media","vulnerabilityIds":["CVE-2025-66490","CVE-2025-66491"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-201730","identifiers":["EUVD-2025-201730","CVE-2025-66491","GHSA-7vww-mvcr-x6vj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}