CVE-2026-114656: Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Traefik deployments before 2.11.58 or 3.7.13 are affected when a router rule uses a negated Host matcher, such as !Host(), and the resulting TLS options conflict causes Traefik to fall back to default TLS options. Backends expected to require RequireAndVerifyClientCert are the relevant exposure.
What does an attacker need to exploit the issue?
An attacker can exploit the condition remotely without authentication or user interaction. The affected routing and TLS-options configuration must be present so that client-certificate checks are skipped.
Does this affect every Traefik deployment using mTLS?
The described bypass depends on a router rule containing a negated Host matcher and a TLS options conflict that falls back to default options. The provided information does not indicate that deployments without those conditions are affected.
How can I remediate the issue?
Upgrade Traefik to 2.11.58 or later in the 2.11 line, or 3.7.13 or later in the 3.x line. Until an upgrade is possible, identify and remove or redesign router rules using negated Host matchers where they can create the described TLS options conflict.