Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-04T11:30:00 github.com/traefik/traefik: Traefik: Authentication bypass via TLS option conflict 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-303

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.

A flaw was found in Traefik. This vulnerability allows unauthenticated attackers to bypass client-certificate authentication. By creating conflicting Transport Layer Security (TLS) options on multi-host routers, attackers can exploit shared TLS resolution across multiple hostnames in a single router rule. This causes the strict mutual TLS (mTLS) requirement to fall back to default options, enabling access to protected backends.

A flaw was found in Traefik before v2.11.55 and v3.0.0 through v3.7.10, where multi-host router configurations fail to isolate TLS options. When shared router rules encompass multiple hostnames, conflicting TLS settings cause strict mTLS enforcement to regress to default configuration parameters across all associated endpoints. Within Red Hat environments utilizing affected Traefik versions, an unauthenticated remote attacker can exploit this fallback behavior to bypass client-certificate authentication controls and access protected backend services without valid credentials. Separate multi-host router rules into dedicated single-host routers so each domain explicitly defines its required TLS options without inheritance conflicts. Alternatively, enforce client-certificate authentication at an upstream ingress controller or API gateway before traffic reaches the Traefik router. Red Hat OpenShift Dev Spaces Affected devspaces/traefik-rhel9 Red Hat OpenShift GitOps Not affected openshift-gitops-1/argo-rollouts-rhel8 Red Hat OpenShift GitOps Not affected openshift-gitops-1/argo-rollouts-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-85597 https://nvd.nist.gov/vuln/detail/CVE-2026-85597 https://github.com/traefik/traefik/security/advisories/GHSA-g55h-rg46-x9c5 https://www.vulncheck.com/advisories/traefik-before-2.11.55-mtls-bypass-via-tls-option-conflict