Vulnerabilities

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil.

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

Read at NIST National Vulnerability Database (CVE API 2.0)

Product

Squid / HAProxy / Varnish, Go / Rust toolchains

CVSS

8.7

EPSS

0.002 (p8)

Exposure class

Edge / VPN / firewall, Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-114635 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 22
   CVE NVD 10d ago

   Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate…

   CVSS 7.5 CVE-2026-114656
2. 22
   CVE NVD 10d ago

   Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards…

   CVSS 8.7 CVE-2026-114640 Kubernetes
3. 28
   CVE NVD 10d ago

   Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an…

   CVSS 8.7 CVE-2026-114639 Microsoft
4. 22
   CVE NVD 10d ago

   Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when…

   CVSS 8.7 CVE-2026-114638 F5 Kubernetes
5. 28
   CVE NVD 10d ago

   Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin…

   CVSS 8.7 CVE-2026-114637 Microsoft