high7.5
CVE-2026-114656
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because…
Impact
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Traefik | Traefik | before 2.11.58 from 3.0.0 before 3.7.13 |