WS-2026-0159

github.com/traefik/traefik/v3 v3.7.0-rc.1 - v3.7.13: the Ingress-NGINX provider does not strip client-supplied Ssl-Client- headers on the plaintext HTTP router of an auth-tls-pass-certificate-to-upstream Ingress, so a client can forge an mTLS identity for the backend GHSA-mwrr-6hp4-pxr6...