Traefik CVE-2026-85597

Exploitation requires Traefik versions before v2.11.55 to be deployed with at least one router rule that covers multiple hostnames (e.g., Host(a.example.com, b.example.com)) where those hostnames are associated with conflicting TLS options - specifically, where one or more hosts are configured to require mutual TLS (client certificates) and the conflict causes Traefik to fall back to the default TLS options (which do not enforce client certificates). Deployments using only single-hostname routers, or those that do not use Traefik-layer mTLS enforcement at all, are not vulnerable. No attacker authentication, privileges, or user interaction are required once the vulnerable configuration is present; exploitation is purely network-accessible from any client that can reach the Traefik listener.

The CVSS 4.0 base score of 8.2 reflects a network-exploitable, zero-privilege, no-interaction attack with high confidentiality impact. However, the AT:P (Attack Requirements Present) metric is critical: exploitation is contingent on a specific deployment condition - at least one multi-host router rule where conflicting TLS options exist - being already present in the target environment. This substantially narrows real-world exposure; deployments using only single-host routers, or those not relying on Traefik-layer mTLS enforcement, are entirely unaffected. No EPSS score, KEV status, or confirmed public exploit code is provided in the available data, so exploitation probability cannot be independently quantified. For organizations using Traefik mTLS to gate access to sensitive backends (a common cloud-native pattern), the risk is significant when the misconfiguration exists: a silent, authentication-free bypass of a trust boundary. CVSS integrity and availability impacts are both N, consistent with the bypass granting read/connection access rather than modification or denial capabilities.

An attacker identifies a Traefik deployment where a router covers two hostnames - one of which is meant to enforce client-certificate authentication - and the TLS option conflict triggers fallback to default (no-mTLS) settings. The attacker sends a standard HTTPS request to the target hostname without a client certificate; Traefik, operating in fallback mode, accepts the connection and proxies the request to the mTLS-protected backend. No public exploit code is confirmed, and the attack requires only standard HTTPS tooling once the vulnerable routing configuration is identified.