mTLS Bypass Vulnerability in Traefik HTTP Reverse Proxy and Load Balancer
CVE-2026-32305
7.8HIGH
What is CVE-2026-32305?
The mTLS bypass vulnerability in Traefik arises from its handling of fragmented ClientHello packets. When packets are split, Traefik may fail to extract the SNI, leading to a default TLS configuration that doesn't enforce mutual TLS authentication. Consequently, attackers can exploit this vulnerability to access services intended to be protected by client certificate verification. This issue has been addressed in the latest versions, ensuring enhanced security and integrity of the traffic routing.
Affected Version(s)
traefik < 2.11.41 < 2.11.41
traefik >= 3.0.0-beta1, < 3.6.11 < 3.0.0-beta1, 3.6.11
traefik >= 3.7.0-ea.1, < 3.7.0-ea.2 < 3.7.0-ea.1, 3.7.0-ea.2