CVE-2026-114635 traefik CVE debrief

Who should care

Defenders managing Traefik instances, especially those requiring client certificates, should assess exposure and prioritize verification and potential updates. Operators of Traefik instances, platform administrators, and security teams should review the vulnerability and take necessary actions to mitigate the risk. Vulnerability management and security teams should verify Traefik instance versions and configurations to assess exposure and prioritize patch,

Why it matters

CVE-2026-114635 is an authentication bypass vulnerability in Traefik's SNI check, affecting versions before v2.11.58 and v3.7.14. Unauthenticated clients can bypass authentication by sending specific HTTP/2 requests over TLS. Defenders managing Traefik instances, especially those requiring client certificates, should assess exposure and prioritize verification and potential updates.

• Potential unauthorized access to protected resources.
• Possible bypass of client certificate requirements.
• Need for verification of Traefik instance versions and configurations.
• Potential impact on security posture due to authentication bypass.

Technical summary

The vulnerability is caused by Traefik skipping the SNI check when the request TLS state is nil. This allows unauthenticated clients to send HTTP/2 requests with the :scheme http pseudo-header over TLS to reach routers requiring client certificates without presenting one. The issue affects Traefik versions before v2.11.58 and v3.7.14. Defenders should prioritize verifying exposure of Traefik instances, especially those requiring client certificates, and assess the need for updates or compensating controls. The vulnerability may allow unauthorized access to protected resources and bypass client certificate requirements.

Defensive priority

Defenders should prioritize verifying exposure of Traefik instances, especially those requiring client certificates, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify Traefik instance versions and compare to affected versions (before v2.11.58 and v3.7.14).
• Assess exposure of Traefik instances requiring client certificates.
• Consider updating to v2.11.58 or v3.7.14, or applying compensating controls.
• Monitor for unusual HTTP/2 request patterns.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Vendor advisories are available for affected versions. The vulnerability has been publicly disclosed and may be exploited. Defenders should verify Traefik instance versions and configurations to assess exposure. The CVE Program and NVD provide official records and assessments of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.