CVE-2026-114635: Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Affected deployments are Traefik versions before 2.11.58 or 3.7.14 that are built with Go 1.27 and expose routers requiring client certificates. The bypass requires HTTP/2 traffic over TLS.
What does an attacker need to exploit the issue?
An attacker does not need authentication or user interaction. They need to send an HTTP/2 request over TLS with the :scheme pseudo-header set to http, causing the request TLS state to be nil and the SNI check to be skipped.
Does this affect routers that require client certificates?
Yes. The described impact is that unauthenticated clients can reach routers requiring client certificates without presenting a certificate when the affected request conditions are met.
How can I determine whether my instance is potentially affected?
Check whether Traefik is older than 2.11.58 in the 2.x line or older than 3.7.14 in the 3.x line, and whether it was built with Go 1.27. Also identify TLS-enabled HTTP/2 entry points that route to services requiring client certificates.