{"id":"GHSA-fh26-gfpp-7xxx","kind":"vulnerability","aliases":["GHSA-fh26-gfpp-7xxx"],"related":[],"title":"snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's SNI check, which makes sure a request received on a TLS connection is only served by an HTTP router whose TLS options match the ones negotiated for that connection. The check was skipped entirely when the request carried no TLS connection state. Traefik built with Go 1.27 leaves that state unset for HTTP/2 requests sent with the `:scheme http` pseudo-header over a TLS connection, so an unauthenticated client could have such a request served by a router with different TLS options, for example one requiring a client certificate, without presenting one. Official Traefik binaries and images are built with Go 1.26 and are not exposed, but any Traefik build made with Go 1.27, including third-party rebuilds, is; Traefik now always sets the TLS state of requests received on a TLS connection, so the check applies whatever the toolchain.\n\nTraefik v3 versions below v3.7 are affected but are no longer maintained and will not receive a patch of their own; the remedy for those users is to upgrade to a maintained, patched version.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.58\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik skips its check that a TLS request is served by a router with matching TLS options when the request carries no TLS state. Traefik builds made with Go 1.27 leave that state unset for HTTP/2 requests using the `:scheme http` pseudo-header, so an unauthenticated client may reach a router that requires a client certificate without presenting one.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.58"],"affected":"<= v2.11.57","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.14"],"affected":">= v3.0.0, <= v3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","kubernetes","package","self-hosted","traefik"],"not_affected_if":["go-1.26-build","no-client-cert-routers","official-binaries"],"how_to_check":"- Run `traefik version` and compare against the affected ranges: v2 up to `v2.11.57`, v3 from `v3.0.0` up to `v3.7.13`.\n- Check the Go toolchain used to build the binary (`go version -m $(which traefik)`); builds made with Go 1.27 are exposed, official Go 1.26 binaries are not.\n- Look for routers that rely on TLS options such as client certificate requirements.","fix":"- Traefik v2: upgrade to `v2.11.58`\n- Traefik v3: upgrade to `v3.7.14`\n- Traefik v3 below `v3.7` is no longer maintained and gets no patch of its own; upgrade to a patched version.","status":"open","published_at":"2026-10-07T08:47:28+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","triaged_at":"2026-11-09T23:00:32+00:00","updated_at":"2026-11-09T23:00:32+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T23:00:32Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2: upgrade to `v2.11.58`\n- Traefik v3: upgrade to `v3.7.14`\n- Traefik v3 below `v3.7` is no longer maintained and gets no patch of its own; upgrade to a patched version.","reach":"internet","title":"Traefik: SNI check skipped on HTTP/2 requests, bypassing TLS router options","impact":"medium","summary":"Traefik skips its check that a TLS request is served by a router with matching TLS options when the request carries no TLS state. Traefik builds made with Go 1.27 leave that state unset for HTTP/2 requests using the `:scheme http` pseudo-header, so an unauthenticated client may reach a router that requires a client certificate without presenting one.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traefik","go","self-hosted","kubernetes"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated clients reach routers requiring client certificates","analyst_note":"","how_to_check":"- Run `traefik version` and compare against the affected ranges: v2 up to `v2.11.57`, v3 from `v3.0.0` up to `v3.7.13`.\n- Check the Go toolchain used to build the binary (`go version -m $(which traefik)`); builds made with Go 1.27 are exposed, official Go 1.26 binaries are not.\n- Look for routers that rely on TLS options such as client certificate requirements.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["official-binaries","go-1.26-build","no-client-cert-routers"],"who_is_affected":"Exposure depends on the Go toolchain used to build Traefik: official binaries and images built with Go 1.26 are not affected, but any build made with Go 1.27, including third-party rebuilds, is. Look at routers that enforce TLS options such as client certificates, since those are what the bypass defeats; a deployment that serves no such routers has less to lose.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000873,"input_tokens":5065,"output_tokens":733,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'/traefik/traefik/issues).':307C '/traefik/traefik/releases/tag/v2.11.58':284C '/traefik/traefik/releases/tag/v3.7.14':287C '/traefik/traefik/v2':24A '/traefik/traefik/v3':27A '1.26':207C '1.27':64B,151C,219C '7xxx':16A,21A 'advisori':300C 'affect':253C 'alway':228C 'appli':243C 'binari':200C 'build':60B,215C 'built':148C,204C 'carri':55B,142C 'certif':91B,194C 'check':4A,38B,106C,135C,242C 'client':82B,90B,174C,193C 'comment':297C 'connect':116C,133C,145C,170C,239C 'could':175C 'differ':185C 'entir':138C 'exampl':189C 'expos':211C 'fh26':14A,19A 'gfpp':15A,20A 'ghsa':13A,18A 'ghsa-fh26-gfpp-7xxx':12A,17A 'github.com':23A,26A,283C,286C,306C 'github.com/traefik/traefik/issues).':305C 'github.com/traefik/traefik/releases/tag/v2.11.58':282C 'github.com/traefik/traefik/releases/tag/v3.7.14':285C 'github.com/traefik/traefik/v2':22A 'github.com/traefik/traefik/v3':25A 'go':28B,63B,150C,206C,218C 'header':78B,166C 'high':99C 'host':33B 'http':11A,75B,122C,163C 'http/2':9A,70B,157C 'imag':202C 'includ':220C 'inform':290C 'issu':304C 'kubernet':29B 'leav':65B,152C 'longer':257C 'made':61B,216C 'maintain':258C,278C 'make':108C 'match':49B,127C 'may':83B 'negoti':130C 'nil':8A 'offici':198C 'one':94B,129C,190C,197C 'open':302C 'option':51B,126C,187C 'packag':30B 'parti':223C 'patch':264C,279C,281C 'pleas':301C 'present':93B,196C 'pseudo':77B,165C 'pseudo-head':76B,164C 'question':295C 'reach':84B 'rebuild':224C 'receiv':112C,235C,262C 'remedi':269C 'req.tls':6A 'request':42B,54B,71B,111C,141C,158C,179C,234C 'requir':88B,191C 'router':47B,86B,123C,183C 'scheme':10A,74B,162C 'self':32B 'self-host':31B 'sent':159C 'serv':44B,119C,180C 'set':229C 'sever':100C 'skip':2A,36B,137C 'sni':105C 'snicheck':1A 'state':58B,67B,146C,154C,232C 'summari':95C 'sure':109C 'third':222C 'third-parti':221C 'tls':41B,50B,57B,115C,125C,144C,169C,186C,231C,238C 'toolchain':246C 'traefik':34B,35B,59B,103C,147C,199C,214C,226C,247C 'unauthent':81B,173C 'unset':68B,155C 'upgrad':275C 'use':72B 'user':272C 'v3':248C 'v3.7':251C 'version':249C,280C 'vulner':101C 'whatev':244C 'whose':124C 'without':92B,195C","nicknames":[],"mitigations":[],"who_affected":"Exposure depends on the Go toolchain used to build Traefik: official binaries and images built with Go 1.26 are not affected, but any build made with Go 1.27, including third-party rebuilds, is. Look at routers that enforce TLS options such as client certificates, since those are what the bypass defeats; a deployment that serves no such routers has less to lose.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["go","high","kubernetes","package","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v2':24A '/traefik/traefik/v3':27A '7xxx':16A,21A 'check':4A 'fh26':14A,19A 'gfpp':15A,20A 'ghsa':13A,18A 'ghsa-fh26-gfpp-7xxx':12A,17A 'github.com':23A,26A 'github.com/traefik/traefik/v2':22A 'github.com/traefik/traefik/v3':25A 'http':11A 'http/2':9A 'nil':8A 'req.tls':6A 'scheme':10A 'skip':2A 'snicheck':1A","search_b":"'1.27':64B 'build':60B 'carri':55B 'certif':91B 'check':38B 'client':82B,90B 'go':28B,63B 'header':78B 'host':33B 'http':75B 'http/2':70B 'kubernet':29B 'leav':65B 'made':61B 'match':49B 'may':83B 'one':94B 'option':51B 'packag':30B 'present':93B 'pseudo':77B 'pseudo-head':76B 'reach':84B 'request':42B,54B,71B 'requir':88B 'router':47B,86B 'scheme':74B 'self':32B 'self-host':31B 'serv':44B 'skip':36B 'state':58B,67B 'tls':41B,50B,57B 'traefik':34B,35B,59B 'unauthent':81B 'unset':68B 'use':72B 'without':92B","search_c":"'/traefik/traefik/issues).':307C '/traefik/traefik/releases/tag/v2.11.58':284C '/traefik/traefik/releases/tag/v3.7.14':287C '1.26':207C '1.27':151C,219C 'advisori':300C 'affect':253C 'alway':228C 'appli':243C 'binari':200C 'build':215C 'built':148C,204C 'carri':142C 'certif':194C 'check':106C,135C,242C 'client':174C,193C 'comment':297C 'connect':116C,133C,145C,170C,239C 'could':175C 'differ':185C 'entir':138C 'exampl':189C 'expos':211C 'github.com':283C,286C,306C 'github.com/traefik/traefik/issues).':305C 'github.com/traefik/traefik/releases/tag/v2.11.58':282C 'github.com/traefik/traefik/releases/tag/v3.7.14':285C 'go':150C,206C,218C 'header':166C 'high':99C 'http':122C,163C 'http/2':157C 'imag':202C 'includ':220C 'inform':290C 'issu':304C 'leav':152C 'longer':257C 'made':216C 'maintain':258C,278C 'make':108C 'match':127C 'negoti':130C 'offici':198C 'one':129C,190C,197C 'open':302C 'option':126C,187C 'parti':223C 'patch':264C,279C,281C 'pleas':301C 'present':196C 'pseudo':165C 'pseudo-head':164C 'question':295C 'rebuild':224C 'receiv':112C,235C,262C 'remedi':269C 'request':111C,141C,158C,179C,234C 'requir':191C 'router':123C,183C 'scheme':162C 'sent':159C 'serv':119C,180C 'set':229C 'sever':100C 'skip':137C 'sni':105C 'state':146C,154C,232C 'summari':95C 'sure':109C 'third':222C 'third-parti':221C 'tls':115C,125C,144C,169C,186C,231C,238C 'toolchain':246C 'traefik':103C,147C,199C,214C,226C,247C 'unauthent':173C 'unset':155C 'upgrad':275C 'user':272C 'v3':248C 'v3.7':251C 'version':249C,280C 'vulner':101C 'whatev':244C 'whose':124C 'without':195C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-fh26-gfpp-7xxx","url":"https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx","severity":"high","published_at":"2026-10-07T08:47:28+00:00","modified_at":"2026-10-07T08:47:28+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","fetched_at":"2026-11-09T22:53:33+00:00","note":null}],"documents":[{"id":2158,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx","title":"GHSA-fh26-gfpp-7xxx: snicheck skips the check when req.TLS is nil (Traefik)","kind":"advisory","source":"analyst","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:28+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}