CVE-2026-114635CWE-288

Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme

High · published October 22, 2026

CVSS v3.1
8.7
EPSS
—
In the wild
Unconfirmed
What it is

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
7.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
Not scored
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-10-22T01:43Z
Timeline
  • 22 OCT 01:43Z
    Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
    cvelistv5
  • 22 OCT 01:43Z
    Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
    cvelistv5