CVE-2026-114635
Description
A flaw was found in Traefik. The application improperly skips Server Name Indication (SNI) checks when processing certain Transport Layer Security (TLS) connection states. An unauthenticated remote attacker can exploit this issue by sending crafted HTTP/2 requests over TLS to bypass client certificate authentication and gain unauthorized access to protected routes.
Statement
This vulnerability is rated as Important because successful exploitation allows remote, unauthenticated attackers to bypass mutual TLS authentication and access restricted routes, potentially compromising sensitive backend services. The flaw specifically manifests when processing HTTP/2 traffic over encrypted connections where malicious requests omit expected TLS state checks during routing decisions. Traefik is not packaged or shipped as part of Red Hat Enterprise Linux, meaning standard Red Hat environments are not directly exposed by default.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
