{"id":"CVE-2025-66491","aliases":["GHSA-7vww-mvcr-x6vj","GO-2025-4205"],"title":"Traefik Inverted TLS Verification Logic in ingress-nginx Provider","summary":"Traefik Inverted TLS Verification Logic in ingress-nginx Provider","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"traefik","product":"github.com/traefik/traefik/v3","ecosystem":"go","affected":["github.com/traefik/traefik/v3 >= 3.5.0, < 3.6.3"],"patched":["github.com/traefik/traefik/v3 3.6.3"],"published":"2025-12-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:31.689588670Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7vww-mvcr-x6vj","references":[{"url":"https://github.com/traefik/traefik/security/advisories/GHSA-7vww-mvcr-x6vj"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66491"},{"url":"https://github.com/traefik/traefik/commit/14a1aedf5704673d875d210d7bacf103a43c77e4"},{"url":"https://github.com/traefik/traefik"},{"url":"https://github.com/traefik/traefik/releases/tag/v3.6.3"}],"tags":["osv","go"],"epss":0.00221,"epssPercentile":0.11222,"ingestedAt":"2026-09-12T03:13:01.765Z","slug":"CVE-2025-66491","body":"## Overview\n\n## Impact\n\nThere is a potential vulnerability in Traefik NGINX provider managing the `nginx.ingress.kubernetes.io/proxy-ssl-verify` annotation.\n\nThe provider inverts the semantics of the `nginx.ingress.kubernetes.io/proxy-ssl-verify` annotation. Setting the annotation to `\"on\"` (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.3\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n### Summary\n\nA logic error in Traefik's experimental ingress-nginx provider inverts the semantics of the `nginx.ingress.kubernetes.io/proxy-ssl-verify` annotation. Setting the annotation to `\"on\"` (intending to enable backend TLS certificate verification) actually disables verification, allowing man-in-the-middle attacks against HTTPS backends when operators believe they are protected.\n\n### Details\n\nIn `pkg/provider/kubernetes/ingress-nginx/kubernetes.go` at line 512, the `InsecureSkipVerify` field is set using inverted logic:\n\n```go\nnst := &namedServersTransport{\n    Name: provider.Normalize(namespace + \"-\" + name),\n    ServersTransport: &dynamic.ServersTransport{\n        ServerName:         ptr.Deref(cfg.ProxySSLName, ptr.Deref(cfg.ProxySSLServerName, \"\")),\n        InsecureSkipVerify: strings.ToLower(ptr.Deref(cfg.ProxySSLVerify, \"off\")) == \"on\",\n    },\n}\n```\n\nThe expression `== \"on\"` evaluates to `true` when the annotation is `\"on\"`, setting `InsecureSkipVerify: true`. In Go's `crypto/tls`, `InsecureSkipVerify: true` means \"do not verify the server's certificate\" — the opposite of what `proxy-ssl-verify: \"on\"` should do according to NGINX semantics.\n\n**Current behavior:**\n| Annotation Value | InsecureSkipVerify | Actual Result |\n|------------------|-------------------|---------------|\n| `\"on\"` | `true` | Verification **disabled** ❌ |\n| `\"off\"` (default) | `false` | Verification **enabled** |\n\n**Expected behavior (per NGINX semantics):**\n| Annotation Value | InsecureSkipVerify | Expected Result |\n|------------------|-------------------|-----------------|\n| `\"on\"` | `false` | Verification **enabled** |\n| `\"off\"` (default) | `true` | Verification **disabled** |\n\nThe test in `pkg/provider/kubernetes/ingress-nginx/kubernetes_test.go` lines 397-403 confirms this inverted behavior is codified as \"expected\":\n\n```go\nServersTransports: map[string]*dynamic.ServersTransport{\n    \"default-ingress-with-proxy-ssl\": {\n        ServerName:         \"whoami.localhost\",\n        InsecureSkipVerify: true,  // Wrong: should be false when annotation is \"on\"\n        RootCAs:            []types.FileOrContent{\"-----BEGIN CERTIFICATE-----\"},\n    },\n},\n```\n\n**Affected versions:** v3.5.0 through current master (introduced in commit `9bd5c617820f2a8d23b50b68d114bb7bc464eccd`)\n\nPavel Kohout\nAisle Research\n</details>\n\n-\n\n## Affected packages\n\n- `github.com/traefik/traefik/v3 >= 3.5.0, < 3.6.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/traefik/traefik/v3 3.6.3`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}