Authentication Bypass in Traefik Product by Traefik Labs
CVE-2026-114656

6.9MEDIUM

Key Information:

Vendor

Traefik

Status
Traefik
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114656?

Traefik versions prior to 2.11.58 and 3.7.13 suffer from an authentication bypass issue that permits unauthorized clients to evade client-certificate verification. This vulnerability emerges when negated Host matchers are improperly regarded as valid domains, leading to a conflict with TLS options. Consequently, attacks can exploit the RequireAndVerifyClientCert routing rule, allowing unauthorized access to protected backends.

Affected Version(s)

traefik 0 < 2.11.58

traefik 3.0.0 < 3.7.13

traefik 2.11.58

References

https://github.com/traefik/traefik/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/traefik-before-2.11....
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.