6.9
Medium
CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher
Description
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:NExploitable remotely over the network, without an account and without any user action; with no direct impact on the vulnerable system.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- Interaction
- None
- Confidentiality
- None
- Integrity
- None
- Availability
- None
- Confidentiality of other systems
- High
- Integrity of other systems
- Low
- Availability of other systems
- None
Affected products and versions
Other CVEs of traefik
The 80 CVEs of traefik →
CVE-2026-121966
Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
7.0
High
CVE-2026-119574
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated…
8.2
High
CVE-2026-119573
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the…
2.1
Low
CVE-2026-119572
Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
7.0
High