Vulnerability Description
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Traefik | Traefik | < 2.11.58 |
Related Weaknesses (CWE)
References
- https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxxVendor Advisory
- https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-sni-checkThird Party Advisory
FAQ
What is CVE-2026-114635?
CVE-2026-114635 is a vulnerability with a CVSS score of 8.7 (HIGH). Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests w...
How severe is CVE-2026-114635?
CVE-2026-114635 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114635?
Check the references section above for vendor advisories and patch information. Affected products include: Traefik Traefik.