REDHAT-BUG-2449595: High severity Traefik traefik vulnerability
Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS authentication. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 2.11.41 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.6.11 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.7.0-ea.2
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments are exposed when Traefik uses TCP routing with route-level mutual TLS enforcement and the fallback default TLS configuration does not require client certificates. The default TLS configuration does not require client certificates by default.
What must an attacker do to exploit the issue?
An attacker must send a TLS ClientHello fragmented across multiple TLS records. This can cause SNI extraction to return an empty value, making the TCP router select the default TLS configuration instead of the route-specific mTLS configuration.
How can the risk be reduced before an update is applied?
Configure the default TLS configuration to require client certificates, so fallback routing does not remove the mTLS requirement. This addresses the condition that makes an empty SNI fall back to a non-mTLS default configuration.
Which versions contain the fix?
The issue is patched in Traefik 2.11.41, 3.6.11, and 3.7.0-ea.2.