{"id":"CVE-2026-114635","kind":"vulnerability","aliases":["CVE-2026-114635"],"related":[],"title":"Traefik: TLS SNI check skipped, bypasses client certificate requirement on routers","description":"Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.","summary":"Traefik's SNI check, which makes sure a request is served only by a router whose TLS options match the connection, was skipped when the request had no TLS state. Builds made with Go 1.27 leave that state unset for HTTP/2 requests with :scheme http sent over TLS. An unauthenticated client can then reach a router that requires a client certificate without presenting one. Official Traefik binaries and images are built with Go 1.26 and are not exposed. Third-party rebuilds with Go 1.27 are. Traefik v3 releases below 3.7 are affected too but get no patch, so those users must move to 3.7.14.","severity":"high","cvss":8.7,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[{"name":"traefik","fixed":["2.11.58"],"affected":"<= 2.11.57 (Go 1.27 builds)","ecosystem":"go"},{"name":"traefik","fixed":["3.7.14"],"affected":">= 3.0.0, <= 3.7.13 (Go 1.27 builds)","ecosystem":"go"}],"ecosystems":["go"],"tags":["go-1.27","mtls","reverse-proxy","runtime","self-hosted","traefik"],"not_affected_if":["go-1.26","no-client-cert-routers","official-binary","official-image","pre-go-1.27-build"],"how_to_check":"Skip this if you run an official Traefik binary or image, which uses Go 1.26. Otherwise, run 'traefik version' and read its Go version line, or run 'go version -m <traefik binary>'. You are exposed if the build uses Go 1.27 and the version is 2.11.57 or lower, or 3.0.0 to 3.7.13, and you have routers with tls.options that require client certificates (clientAuth). The advisory gives no log signature or test request for detection.","fix":"Upgrade to Traefik v2.11.58 or v3.7.14. Traefik v3 below 3.7 is unmaintained and gets no patch, so move to 3.7.14. The fix always sets the TLS state on requests received over TLS, whatever the Go toolchain. Rebuilding with Go 1.26 is not named as a mitigation in the advisory.","status":"open","published_at":"2026-10-22T02:16:56+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:35:31+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-23T22:35:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Traefik to v2.11.58 or v3.7.14 or later.","reach":"internet","title":"Traefik: TLS SNI check skipped, bypasses client certificate requirement on routers","impact":"high","summary":"Traefik skips its SNI check when the request TLS state is nil, so unauthenticated clients can reach routes that require a client certificate. The attack works by sending HTTP/2 requests with a :scheme http pseudo-header over TLS on Go 1.27 builds.","category":"runtime","who_cares":["traefik","mtls","go-1.27"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated clients reach client-certificate-protected routes","analyst_note":"Confirm which Go versions and Traefik builds are affected and whether the sources give a detection method for routers requiring client certificates.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-client-cert-routers","pre-go-1.27-build"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000486,"input_tokens":2938,"output_tokens":385,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm which Go versions and Traefik builds are affected and whether the sources give a detection method for routers requiring client certificates.","search":"'-1.27':21B '-114635':14A,17A '-2026':13A,16A '1.26':104B '1.27':65B,115B,176C '3.7':121B '3.7.14':135B 'affect':123B 'authent':143C 'binari':97B 'build':61B,177C 'built':101B 'bypass':6A,144C 'certif':8A,91B,183C 'check':4A,34B,149C 'client':7A,81B,90B,160C,182C 'connect':51B 'contain':141C 'cve':12A,15A 'expos':108B 'get':126B 'go':20B,64B,103B,114B,175C 'header':171C 'host':29B 'http':75B,168C 'http/2':71B,163C 'imag':99B 'leav':66B 'made':62B 'make':36B 'match':49B 'move':133B 'mtls':22B 'must':132B 'nil':158C 'offici':95B 'one':94B,186C 'option':48B 'parti':111B 'patch':128B 'present':93B,185C 'proxi':25B 'pseudo':170C 'pseudo-head':169C 'reach':84B,179C 'rebuild':112B 'releas':119B 'request':39B,56B,72B,154C,164C 'requir':9A,88B,181C 'revers':24B 'reverse-proxi':23B 'router':11A,45B,86B,180C 'runtim':26B 'scheme':74B,167C 'self':28B 'self-host':27B 'send':162C 'sent':76B 'serv':41B 'skip':5A,53B,152C 'sni':3A,33B,148C 'state':60B,68B,156C 'sure':37B 'third':110B 'third-parti':109B 'tls':2A,47B,59B,78B,155C,173C 'traefik':1A,18A,19A,30B,31B,96B,117B,136C 'unauthent':80B,159C 'unset':69B 'user':131B 'v2.11.58':138C 'v3':118B 'v3.7.14':140C 'vulner':145C 'whose':46B 'without':92B,184C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114635","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114635","severity":null,"published_at":"2026-10-22T02:16:56+00:00","modified_at":"2026-10-22T15:39:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114635:513","url":null,"severity":null,"published_at":"2026-10-23T23:46:20+00:00","modified_at":"2026-10-23T23:46:20+00:00","first_seen_at":"2026-10-23T23:46:20+00:00","fetched_at":"2026-10-23T23:46:20+00:00","note":"Read Traefik's GHSA-fh26-gfpp-7xxx and the 2026-10-07 community post. Key fact: only builds made with Go 1.27 are exposed. Official binaries and images use Go 1.26 and are not. No PoC or exploitation found; I did not search social posts."},{"source":"epss","external_id":"CVE-2026-114635","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114635","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2158,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx","title":"GHSA-fh26-gfpp-7xxx: snicheck skips the check when req.TLS is nil (Traefik)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2146,"url":"https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-58-and-3-7-3-7-14/30268","title":"Traefik security update 2.11.58 and 3.7.14","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}