{"id":"GHSA-2272-4vv8-65ww","kind":"vulnerability","aliases":["GHSA-2272-4vv8-65ww"],"related":[],"title":"Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host","description":"## Summary\n\nThere is a medium severity vulnerability in Traefik's TLS options resolution: a negated `Host` matcher in a router rule (for example ``PathPrefix(`/`) && !Host(`secure.example.com`)``) is still counted as a host served by that router when the domains are deduced from the rule. When another router actually serves that host with non-default `tls.options`, Traefik sees two routers claiming the same host with different TLS options, declares a conflict, and falls back to the `default` TLS options for both. Because the `default` options request no client certificate, a `RequireAndVerifyClientCert` policy stops being enforced on that host and an unauthenticated client can reach the protected backend. The downgrade is reported at `ERROR` level in the logs, and setting `core.strictTLSOptions=true` disables the fallback and mitigates the issue.\n\nBoth the v2 and v3 lines are affected. Traefik v3 versions below v3.7 are affected but are no longer maintained and will not receive a patch of their own; the remedy for those users is to upgrade to a maintained, patched version.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.58\n- https://github.com/traefik/traefik/releases/tag/v3.7.13\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik treats a negated Host matcher in a router rule as a host served by that router, which can make two routers conflict on TLS options and fall back to the default options. The default options do not request client certificates, so a host that required client-certificate authentication accepts unauthenticated clients and reaches the backend.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.58"],"affected":"<= v2.11.57","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.13"],"affected":">= v3.0.0, <= v3.7.12","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-436","cwe-863","kubernetes","mtls","package","self-hosted","tls","traefik"],"not_affected_if":["default-config","no-client-cert-auth","strict-tls-options"],"how_to_check":"- Check the Traefik version with `traefik version` or the container image tag; affected are v2 up to `2.11.57` and v3 from `3.0.0` up to `3.7.12`.\n- Look for routers whose rules combine a `PathPrefix` with `!Host(...)` and for `tls.options` settings that require client certificates (`RequireAndVerifyClientCert`).\n- Check the Traefik logs for ERROR-level messages reporting a TLS options conflict.","fix":"- Traefik v2: upgrade to `2.11.58`\n- Traefik v3: upgrade to `3.7.13`\n- Mitigation named by the advisory: set `core.strictTLSOptions=true`, which disables the fallback.","status":"open","published_at":"2026-10-07T08:47:53+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","triaged_at":"2026-11-09T23:00:33+00:00","updated_at":"2026-11-09T23:00:33+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T23:00:33Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2: upgrade to `2.11.58`\n- Traefik v3: upgrade to `3.7.13`\n- Mitigation named by the advisory: set `core.strictTLSOptions=true`, which disables the fallback.","reach":"internet","title":"Traefik: negated Host matcher disables client-certificate checks on excluded host","impact":"medium","summary":"Traefik treats a negated Host matcher in a router rule as a host served by that router, which can make two routers conflict on TLS options and fall back to the default options. The default options do not request client certificates, so a host that required client-certificate authentication accepts unauthenticated clients and reaches the backend.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","tls","mtls"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated clients reach a backend that required client certificates","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` or the container image tag; affected are v2 up to `2.11.57` and v3 from `3.0.0` up to `3.7.12`.\n- Look for routers whose rules combine a `PathPrefix` with `!Host(...)` and for `tls.options` settings that require client certificates (`RequireAndVerifyClientCert`).\n- Check the Traefik logs for ERROR-level messages reporting a TLS options conflict.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-client-cert-auth","strict-tls-options"],"who_is_affected":"Teams running Traefik as a reverse proxy where a router uses a negated Host matcher and another router serves the same host with non-default TLS options that require client certificates. The advisory says v3 releases below 3.7 are no longer maintained and will not get their own patch, so upgrading to a patched version is the remedy. Deployments without client-certificate TLS options on shared hosts are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000869,"input_tokens":5048,"output_tokens":728,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2272':20A,26A '-4':21A,27A '-436':38B '-863':40B '/traefik/traefik/issues).':302C '/traefik/traefik/releases/tag/v2.11.58':279C '/traefik/traefik/releases/tag/v3.7.13':282C '/traefik/traefik/v2':33A '/traefik/traefik/v3':36A '65ww':24A,30A 'accept':99B 'actual':153C 'advisori':295C 'affect':241C,248C 'anoth':151C 'authent':14A,98B 'back':77B,179C 'backend':105B,212C 'caus':4A 'certif':13A,89B,97B,194C 'claim':166C 'client':12A,88B,96B,101B,193C,207C 'client-certif':11A,95B 'comment':292C 'conflict':8A,71B,176C 'core.stricttlsoptions':225C 'count':134C 'cwe':37B,39B 'declar':174C 'deduc':146C 'default':80B,83B,160C,182C,189C 'differ':171C 'disabl':10A,227C 'domain':144C 'downgrad':214C 'enforc':200C 'error':218C 'exampl':128C 'exclud':17A 'fall':76B,178C 'fallback':229C 'ghsa':19A,25A 'github.com':32A,35A,278C,281C,301C 'github.com/traefik/traefik/issues).':300C 'github.com/traefik/traefik/releases/tag/v2.11.58':277C 'github.com/traefik/traefik/releases/tag/v3.7.13':280C 'github.com/traefik/traefik/v2':31A 'github.com/traefik/traefik/v3':34A 'host':2A,18A,46B,53B,61B,92B,121C,130C,137C,156C,169C,203C 'inform':285C 'issu':233C,299C 'kubernet':41B 'level':219C 'line':239C 'log':222C 'longer':252C 'maintain':253C,273C 'make':68B 'matcher':3A,54B,122C 'medium':110C 'mitig':231C 'mtls':42B 'negat':1A,52B,120C 'non':159C 'non-default':158C 'open':297C 'option':7A,74B,81B,84B,117C,173C,184C,190C 'packag':43B 'patch':259C,274C,276C 'pathprefix':129C 'pleas':296C 'polici':197C 'protect':211C 'question':290C 'reach':103B,209C 'receiv':257C 'remedi':264C 'report':216C 'request':87B,191C 'requir':94B 'requireandverifyclientcert':196C 'resolut':118C 'router':57B,65B,70B,125C,141C,152C,165C 'rule':58B,126C,149C 'secure.example.com':131C 'see':163C 'self':45B 'self-host':44B 'serv':62B,138C,154C 'set':224C 'sever':111C 'still':133C 'stop':198C 'summari':106C 'tls':6A,47B,73B,116C,172C,183C 'tls.options':161C 'traefik':48B,49B,114C,162C,242C 'treat':50B 'true':226C 'two':69B,164C 'unauthent':100B,206C 'upgrad':270C 'user':267C 'v2':236C 'v3':238C,243C 'v3.7':246C 'version':244C,275C 'vulner':112C 'vv8':23A,29A 'vv8-65ww':22A,28A","nicknames":[],"mitigations":[],"who_affected":"Teams running Traefik as a reverse proxy where a router uses a negated Host matcher and another router serves the same host with non-default TLS options that require client certificates. The advisory says v3 releases below 3.7 are no longer maintained and will not get their own patch, so upgrading to a patched version is the remedy. Deployments without client-certificate TLS options on shared hosts are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["cwe436","cwe863","go","kubernetes","medium","mtls","package","selfhosted","tls","traefik"],"campaign_type":null,"search_a":"'-2272':20A,26A '-4':21A,27A '/traefik/traefik/v2':33A '/traefik/traefik/v3':36A '65ww':24A,30A 'authent':14A 'caus':4A 'certif':13A 'client':12A 'client-certif':11A 'conflict':8A 'disabl':10A 'exclud':17A 'ghsa':19A,25A 'github.com':32A,35A 'github.com/traefik/traefik/v2':31A 'github.com/traefik/traefik/v3':34A 'host':2A,18A 'matcher':3A 'negat':1A 'option':7A 'tls':6A 'vv8':23A,29A 'vv8-65ww':22A,28A","search_b":"'-436':38B '-863':40B 'accept':99B 'authent':98B 'back':77B 'backend':105B 'certif':89B,97B 'client':88B,96B,101B 'client-certif':95B 'conflict':71B 'cwe':37B,39B 'default':80B,83B 'fall':76B 'host':46B,53B,61B,92B 'kubernet':41B 'make':68B 'matcher':54B 'mtls':42B 'negat':52B 'option':74B,81B,84B 'packag':43B 'reach':103B 'request':87B 'requir':94B 'router':57B,65B,70B 'rule':58B 'self':45B 'self-host':44B 'serv':62B 'tls':47B,73B 'traefik':48B,49B 'treat':50B 'two':69B 'unauthent':100B","search_c":"'/traefik/traefik/issues).':302C '/traefik/traefik/releases/tag/v2.11.58':279C '/traefik/traefik/releases/tag/v3.7.13':282C 'actual':153C 'advisori':295C 'affect':241C,248C 'anoth':151C 'back':179C 'backend':212C 'certif':194C 'claim':166C 'client':193C,207C 'comment':292C 'conflict':176C 'core.stricttlsoptions':225C 'count':134C 'declar':174C 'deduc':146C 'default':160C,182C,189C 'differ':171C 'disabl':227C 'domain':144C 'downgrad':214C 'enforc':200C 'error':218C 'exampl':128C 'fall':178C 'fallback':229C 'github.com':278C,281C,301C 'github.com/traefik/traefik/issues).':300C 'github.com/traefik/traefik/releases/tag/v2.11.58':277C 'github.com/traefik/traefik/releases/tag/v3.7.13':280C 'host':121C,130C,137C,156C,169C,203C 'inform':285C 'issu':233C,299C 'level':219C 'line':239C 'log':222C 'longer':252C 'maintain':253C,273C 'matcher':122C 'medium':110C 'mitig':231C 'negat':120C 'non':159C 'non-default':158C 'open':297C 'option':117C,173C,184C,190C 'patch':259C,274C,276C 'pathprefix':129C 'pleas':296C 'polici':197C 'protect':211C 'question':290C 'reach':209C 'receiv':257C 'remedi':264C 'report':216C 'request':191C 'requireandverifyclientcert':196C 'resolut':118C 'router':125C,141C,152C,165C 'rule':126C,149C 'secure.example.com':131C 'see':163C 'serv':138C,154C 'set':224C 'sever':111C 'still':133C 'stop':198C 'summari':106C 'tls':116C,172C,183C 'tls.options':161C 'traefik':114C,162C,242C 'true':226C 'two':164C 'unauthent':206C 'upgrad':270C 'user':267C 'v2':236C 'v3':238C,243C 'v3.7':246C 'version':244C,275C 'vulner':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-2272-4vv8-65ww","url":"https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww","severity":"medium","published_at":"2026-10-07T08:47:53+00:00","modified_at":"2026-10-07T08:47:53+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","fetched_at":"2026-11-09T22:53:33+00:00","note":null}],"documents":[{"id":46277,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:53+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}