Live › vulnerability › CVE-2026-114656
Go to dashboardTraefik before 2.11.58 and 3.7.13 counts negated Host matchers as served domains, which can create a TLS options conflict that falls back to default options. An unauthenticated client can then reach backends that were meant to require verified client certificates.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments where Traefik terminates TLS for backends that depend on RequireAndVerifyClientCert for access control, and where a router uses a negated Host matcher that creates a TLS options conflict. Setups that do not rely on client certificates at the proxy, or that run patched versions, can skip this.
No product ranges from the sources yet.
traefik version (or check the container image tag) and compare against 2.11.58 and 3.7.13!Host( rules alongside RequireAndVerifyClientCert TLS options in the dynamic configuration2.11.58 or later3.7.13 or later!Host() router rules on routes protected by client-certificate verification (unknown whether this fully mitigates)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
This page as .md · .json · in your agent: get_signal("CVE-2026-114656")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.