GITHUB.COM/TRAEFIK/TRAEFIK/V2 · GHSA-2272-4vv8-65ww · Package
FIX → v2.11.58 · v3.7.13
Traefik treats a negated Host matcher in a router rule as a host served by that router, which can make two routers conflict on TLS options and fall back to the default options. The default options do not request client certificates, so a host that required client-certificate authentication accepts unauthenticated clients and reaches the backend.
first public Oct 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Traefik as a reverse proxy where a router uses a negated Host matcher and another router serves the same host with non-default TLS options that require client certificates. The advisory says v3 releases below 3.7 are no longer maintained and will not get their own patch, so upgrading to a patched version is the remedy. Deployments without client-certificate TLS options on shared hosts are less exposed.
Not affected if default-config, no-client-cert-auth, strict-tls-options
Who cares kubernetes, mtls, self-hosted, tls, traefik
traefik version or the container image tag; affected are v2 up to 2.11.57 and v3 from 3.0.0 up to 3.7.12.PathPrefix with and for settings that require client certificates ().There is a medium severity vulnerability in Traefik's TLS options resolution: a negated Host matcher in a router rule (for example PathPrefix(`/`) && !Host(`secure.example.com`)) is still counted as a host served by that router when the domains are deduced from the rule. When another router actually serves that host with non-default tls.options, Traefik sees two routers claiming the same host with different TLS options, declares a conflict, and falls back to the default TLS options for both. Because the default options request no client certificate, a RequireAndVerifyClientCert policy stops being enforced on that host and an unauthenticated client can reach the protected backend. The downgrade is reported at ERROR level in the logs, and setting core.strictTLSOptions=true disables the fallback and mitigates the issue.
Both the v2 and v3 lines are affected. Traefik v3 versions below v3.7 are affected but are no longer maintained and will not receive a patch of their own; the remedy for those users is to upgrade to a maintained, patched version.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
!Host(...)tls.optionsRequireAndVerifyClientCertUpgrade to v2.11.58 · v3.7.13
2.11.583.7.13core.strictTLSOptions=true, which disables the fallback.If you have any questions or comments about this advisory, please open an issue.