EUVD-2026-71020
GHSA-q42x-32f8-m4r5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures the prerequisite of conflicting multi-host TLS options; S:C applies because the bypass exposes backends that Traefik is the security boundary for.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.
AnalysisAI
Client-certificate authentication (mTLS) in Traefik before v2.11.55 can be silently bypassed by unauthenticated network attackers when routers are configured with multiple hostnames bearing conflicting TLS options. Traefik's conflict resolution logic incorrectly falls back to default (non-mTLS) TLS settings for all hostnames in the affected multi-host router, allowing an attacker to reach mTLS-protected backends without presenting a valid client certificate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Traefik versions before v2.11.55 to be deployed with at least one router rule that covers multiple hostnames (e.g., Host(`a.example.com`, `b.example.com`)) where those hostnames are associated with conflicting TLS options - specifically, where one or more hosts are configured to require mutual TLS (client certificates) and the conflict causes Traefik to fall back to the default TLS options (which do not enforce client certificates). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.2 reflects a network-exploitable, zero-privilege, no-interaction attack with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Traefik to v2.11.55 or later, which corrects the TLS option conflict resolution logic per vendor security advisory GHSA-g55h-rg46-x9c5 (https://github.com/traefik/traefik/security/advisories/GHSA-g55h-rg46-x9c5). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Traefik deployments running versions before 2.11.55 and identify instances using multi-hostname routers with mTLS configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is re
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Namespace confusion in Traefik's Kubernetes Gateway API provider (versions 3.7.0-3.7.6) enables a low-privileged route a
Authorization bypass in Traefik's IngressRouteTCP handler (versions 3.6.0-3.6.22 and 3.7.0-3.7.6) allows a low-privilege
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route pr
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Rated high severity (CVSS 8.8), this vulnerabil
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inheri
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach servi
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today