---
id: "GHSA-fh26-gfpp-7xxx"
page: "https://infrastack.ai/live/GHSA-fh26-gfpp-7xxx"
kind: "vulnerability"
aliases: ["GHSA-fh26-gfpp-7xxx"]
title: "snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.58"], "affected": "<= v2.11.57", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.14"], "affected": ">= v3.0.0, <= v3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "kubernetes", "package", "self-hosted", "traefik"]
not_affected_if: ["go-1.26-build", "no-client-cert-routers", "official-binaries"]
published_at: "2026-10-07T08:47:28+00:00"
first_seen_at: "2026-11-09T22:53:33+00:00"
updated_at: "2026-11-09T23:00:32+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx", "first_seen_at": "2026-11-09T22:53:33+00:00"}]
exploit_sources: []
---

# snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)

Link for people: https://infrastack.ai/live/GHSA-fh26-gfpp-7xxx (this .md is for agents)

Traefik skips its check that a TLS request is served by a router with matching TLS options when the request carries no TLS state. Traefik builds made with Go 1.27 leave that state unset for HTTP/2 requests using the `:scheme http` pseudo-header, so an unauthenticated client may reach a router that requires a client certificate without presenting one.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected <= v2.11.57 fixed v2.11.58
- go:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.7.13 fixed v3.7.14

## How to check

- Run `traefik version` and compare against the affected ranges: v2 up to `v2.11.57`, v3 from `v3.0.0` up to `v3.7.13`.
- Check the Go toolchain used to build the binary (`go version -m $(which traefik)`); builds made with Go 1.27 are exposed, official Go 1.26 binaries are not.
- Look for routers that rely on TLS options such as client certificate requirements.

## Fix

- Traefik v2: upgrade to `v2.11.58`
- Traefik v3: upgrade to `v3.7.14`
- Traefik v3 below `v3.7` is no longer maintained and gets no patch of its own; upgrade to a patched version.

## Timeline

- 2026-11-09T22:53:33+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx

## Documents

- [advisory] GHSA-fh26-gfpp-7xxx: snicheck skips the check when req.TLS is nil (Traefik) https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx

## From the sources

## Summary

There is a high severity vulnerability in Traefik's SNI check, which makes sure a request received on a TLS connection is only served by an HTTP router whose TLS options match the ones negotiated for that connection. The check was skipped entirely when the request carried no TLS connection state. Traefik built with Go 1.27 leaves that state unset for HTTP/2 requests sent with the `:scheme http` pseudo-header over a TLS connection, so an unauthenticated client could have such a request served by a router with different TLS options, for example one requiring a client certificate, without presenting one. Official Traefik binaries and images are built with Go 1.26 and are not exposed, but any Traefik build made with Go 1.27, including third-party rebuilds, is; Traefik now always sets the TLS state of requests received on a TLS connection, so the check applies whatever the toolchain.

Traefik v3 versions below v3.7 are affected but are no longer maintained and will not receive a patch of their own; the remedy for those users is to upgrade to a maintained, patched version.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.58
- https://github.com/traefik/traefik/releases/tag/v3.7.14

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_