CVE-2026-85597: Traefik before v2.11.55 mTLS Bypass via TLS Option Conflict
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Traefik deployments before v2.11.55 are exposed when a router uses a multi-host rule with conflicting TLS options. The issue is specifically relevant where one or more hosts are expected to enforce strict mTLS client-certificate authentication.
Does an attacker need a client certificate or prior access to exploit this?
No. The vulnerability allows unauthenticated attackers to bypass client-certificate authentication and reach protected backends when the TLS option conflict causes resolution to fall back to default options.
How can I identify configurations at risk?
Review routers that serve multiple hostnames in a single rule and compare the TLS options resolved for those hosts. Configurations with conflicting TLS options, particularly where strict mTLS is intended for protected backends, should be treated as at risk until updated to v2.11.55 or later.