CVE-2026-114635High· 8.7▾ TwilightTraefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header ov…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
traefik < 2.11.58traefik >= 3.0.0 < 3.7.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48491HighTraefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
CVE-2026-53622HighTraefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
CVE-2026-114639High· 8.7Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
CVE-2026-114636High· 8.7Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
CVE-2026-114640High· 8.7Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router
CVE-2026-114638High· 8.7Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision