HIGH 7.0 NVD
CVE-2026-114635
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenti
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
References
- https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx
- https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-sni-check-bypass-vi
This high severity vulnerability with a CVSS score of 7.0 was published on 2026-10-22 via NVD.
vulnfeed aggregates 18809 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.