---
id: "GHSA-2272-4vv8-65ww"
page: "https://infrastack.ai/live/GHSA-2272-4vv8-65ww"
kind: "vulnerability"
aliases: ["GHSA-2272-4vv8-65ww"]
title: "Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.58"], "affected": "<= v2.11.57", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.13"], "affected": ">= v3.0.0, <= v3.7.12", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-436", "cwe-863", "kubernetes", "mtls", "package", "self-hosted", "tls", "traefik"]
not_affected_if: ["default-config", "no-client-cert-auth", "strict-tls-options"]
published_at: "2026-10-07T08:47:53+00:00"
first_seen_at: "2026-11-09T22:53:33+00:00"
updated_at: "2026-11-09T23:00:33+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww", "first_seen_at": "2026-11-09T22:53:33+00:00"}]
exploit_sources: []
---

# Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host

Link for people: https://infrastack.ai/live/GHSA-2272-4vv8-65ww (this .md is for agents)

Traefik treats a negated Host matcher in a router rule as a host served by that router, which can make two routers conflict on TLS options and fall back to the default options. The default options do not request client certificates, so a host that required client-certificate authentication accepts unauthenticated clients and reaches the backend.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected <= v2.11.57 fixed v2.11.58
- go:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.7.12 fixed v3.7.13

## How to check

- Check the Traefik version with `traefik version` or the container image tag; affected are v2 up to `2.11.57` and v3 from `3.0.0` up to `3.7.12`.
- Look for routers whose rules combine a `PathPrefix` with `!Host(...)` and for `tls.options` settings that require client certificates (`RequireAndVerifyClientCert`).
- Check the Traefik logs for ERROR-level messages reporting a TLS options conflict.

## Fix

- Traefik v2: upgrade to `2.11.58`
- Traefik v3: upgrade to `3.7.13`
- Mitigation named by the advisory: set `core.strictTLSOptions=true`, which disables the fallback.

## Timeline

- 2026-11-09T22:53:33+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww

## From the sources

## Summary

There is a medium severity vulnerability in Traefik's TLS options resolution: a negated `Host` matcher in a router rule (for example ``PathPrefix(`/`) && !Host(`secure.example.com`)``) is still counted as a host served by that router when the domains are deduced from the rule. When another router actually serves that host with non-default `tls.options`, Traefik sees two routers claiming the same host with different TLS options, declares a conflict, and falls back to the `default` TLS options for both. Because the `default` options request no client certificate, a `RequireAndVerifyClientCert` policy stops being enforced on that host and an unauthenticated client can reach the protected backend. The downgrade is reported at `ERROR` level in the logs, and setting `core.strictTLSOptions=true` disables the fallback and mitigates the issue.

Both the v2 and v3 lines are affected. Traefik v3 versions below v3.7 are affected but are no longer maintained and will not receive a patch of their own; the remedy for those users is to upgrade to a maintained, patched version.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.58
- https://github.com/traefik/traefik/releases/tag/v3.7.13

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_