GITHUB.COM/TRAEFIK/TRAEFIK/V2 · GHSA-fh26-gfpp-7xxx · Package
FIX → v2.11.58 · v3.7.14
Traefik skips its check that a TLS request is served by a router with matching TLS options when the request carries no TLS state. Traefik builds made with Go 1.27 leave that state unset for HTTP/2 requests using the `:scheme http` pseudo-header, so an unauthenticated client may reach a router that requires a client certificate without presenting one.
first public Oct 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure depends on the Go toolchain used to build Traefik: official binaries and images built with Go 1.26 are not affected, but any build made with Go 1.27, including third-party rebuilds, is. Look at routers that enforce TLS options such as client certificates, since those are what the bypass defeats; a deployment that serves no such routers has less to lose.
Not affected if go-1.26-build, no-client-cert-routers, official-binaries
Who cares go, kubernetes, self-hosted, traefik
traefik version and compare against the affected ranges: v2 up to v2.11.57, v3 from v3.0.0 up to v3.7.13.go version -m $(which traefik)); builds made with Go 1.27 are exposed, official Go 1.26 binaries are not.There is a high severity vulnerability in Traefik's SNI check, which makes sure a request received on a TLS connection is only served by an HTTP router whose TLS options match the ones negotiated for that connection. The check was skipped entirely when the request carried no TLS connection state. Traefik built with Go 1.27 leaves that state unset for HTTP/2 requests sent with the :scheme http pseudo-header over a TLS connection, so an unauthenticated client could have such a request served by a router with different TLS options, for example one requiring a client certificate, without presenting one. Official Traefik binaries and images are built with Go 1.26 and are not exposed, but any Traefik build made with Go 1.27, including third-party rebuilds, is; Traefik now always sets the TLS state of requests received on a TLS connection, so the check applies whatever the toolchain.
Traefik v3 versions below v3.7 are affected but are no longer maintained and will not receive a patch of their own; the remedy for those users is to upgrade to a maintained, patched version.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v2.11.58 · v3.7.14
v2.11.58v3.7.14v3.7 is no longer maintained and gets no patch of its own; upgrade to a patched version.