CVE-2026-114656: traefik traefik

CVSS 9.3 (critical) · published 2026-10-22

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.

Affected products (NVD): traefik traefik

Fixed in (NVD): 2.11.58, 3.7.13

Weakness: CWE-436

Source: NVD CVE-2026-114656

References

• https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww
• https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.13-mtls-bypass-via-negated-host-matcher

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.