Live › vulnerability › CVE-2026-114635
Go to dashboardTraefik's SNI check, which makes sure a request is served only by a router whose TLS options match the connection, was skipped when the request had no TLS state. Builds made with Go 1.27 leave that state unset for HTTP/2 requests with :scheme http sent over TLS. An unauthenticated client can then reach a router that requires a client certificate without presenting one. Official Traefik binaries and images are built with Go 1.26 and are not exposed. Third-party rebuilds with Go 1.27 are. Traefik v3 releases below 3.7 are affected too but get no patch, so those users must move to 3.7.14.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| traefik | go | <= 2.11.57 (Go 1.27 builds) | 2.11.58 |
| traefik | go | >= 3.0.0, <= 3.7.13 (Go 1.27 builds) | 3.7.14 |
traefik version and read its Go version line, or run go version -m <traefik binary>2.11.57 or lower, or 3.0.0 to 3.7.13, and you have routers with tls.options that require client certificates (clientAuth)v2.11.58 or v3.7.143.7.14Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
This page as .md · .json · in your agent: get_signal("CVE-2026-114635")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.