CVE-2026-114656: Traefik Auth Bypass Vulnerability

CVE-2026-114656 Overview

CVE-2026-114656 is an authentication bypass vulnerability in Traefik versions before 2.11.58 and 3.7.13. The flaw allows unauthenticated clients to skip client-certificate checks on routes protected by RequireAndVerifyClientCert. The root cause is interaction error [CWE-436]: negated Host() matchers are counted as served domains, producing a TLS options conflict that silently falls back to the default TLS options. Attackers can reach mutual TLS (mTLS) protected backends without presenting a valid client certificate.

Critical Impact

Remote unauthenticated attackers can bypass mTLS client-certificate verification and access backends that administrators believed were restricted to authenticated clients.

Affected Products

• Traefik versions prior to 2.11.58
• Traefik 3.x versions prior to 3.7.13
• Deployments using router rules with !Host() matchers combined with RequireAndVerifyClientCert

Discovery Timeline

• 2026-10-22 - CVE CVE-2026-114656 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114656

Vulnerability Analysis

Traefik applies TLS options per server name indication (SNI) hostname, based on which domains each router is declared to serve. When a router rule uses a negated host matcher such as !Host("example.com"), Traefik treats the negated hostname as a served domain for TLS options resolution.

This miscounting produces a TLS options conflict for the affected hostname. Traefik resolves the conflict by falling back to the default TLS options, which do not enforce RequireAndVerifyClientCert. The result is that a protected backend becomes reachable over TLS without client-certificate validation.

The vulnerability is categorized under [CWE-436] Interpretation Conflict, reflecting the mismatch between how the router matcher logic and the TLS options resolver interpret negated host rules. Exploitation requires only network access to the Traefik instance and knowledge of a vulnerable routing configuration.

Root Cause

The router configuration parser enumerates hostnames referenced in router rules to associate TLS options with each SNI value. The parser does not distinguish between affirmative Host() matchers and negated !Host() matchers. Both produce entries in the hostname-to-TLS-options map.

When multiple routers claim the same hostname with differing TLS options, Traefik discards the conflicting options and uses defaults. A negated-host router therefore collides with the legitimate mTLS-protected router and strips its client-certificate requirement.

Attack Vector

An attacker sends a TLS request to the Traefik frontend targeting a hostname served by an mTLS-protected router. Because the TLS options have fallen back to defaults, Traefik completes the handshake without demanding a client certificate. The request is then routed to the backend as if authentication had succeeded.

Exploitation requires no credentials, no user interaction, and only network reachability to the proxy. See the GitHub Security Advisory GHSA-2272-4vv8-65ww and the VulnCheck Advisory MTLS Bypass for additional technical detail.

Detection Methods for CVE-2026-114656

Indicators of Compromise

• TLS handshakes completed against mTLS-protected hostnames without a client certificate presented
• Successful backend requests from source IPs that have never enrolled a client certificate
• Traefik access logs showing requests to protected routes with empty TLSClientCertificate fields
• Router configurations containing !Host() rules alongside TLS options that specify clientAuth.clientAuthType: RequireAndVerifyClientCert

Detection Strategies

• Audit all dynamic and static Traefik configuration for router rules using negated host matchers
• Correlate Traefik access logs with expected client-certificate subjects and flag requests missing the certificate field
• Inventory running Traefik versions across environments and compare against the fixed releases 2.11.58 and 3.7.13

Monitoring Recommendations

• Forward Traefik access logs to a centralized analytics platform and alert on authenticated-route access without a certificate subject
• Monitor configuration-reload events for new routers that introduce !Host() matchers
• Instrument backend services to log and alert on requests that arrive without upstream mTLS context

How to Mitigate CVE-2026-114656

Immediate Actions Required

• Upgrade Traefik to version 2.11.58 or 3.7.13 or later on all proxy instances
• Review every router configuration for !Host() matchers and remove or refactor them where mTLS enforcement is required
• Enforce client-certificate validation at the backend service in addition to Traefik, as a defense-in-depth measure

Patch Information

Traefik maintainers fixed the issue in versions 2.11.58 and 3.7.13. The patch corrects the TLS options resolver so that negated host matchers are no longer treated as served domains, preventing the conflict and default-options fallback. Patch details are documented in GitHub Security Advisory GHSA-2272-4vv8-65ww.

Workarounds

• Replace negated host matchers with explicit affirmative Host() rules enumerating permitted domains
• Set the default TLS options to require client-certificate verification, so any fallback still enforces mTLS
• Restrict network access to Traefik frontends serving mTLS routes until the upgrade can be applied

# Harden default TLS options so any fallback still enforces mTLS
# traefik dynamic configuration (YAML)
tls:
  options:
    default:
      minVersion: VersionTLS12
      clientAuth:
        caFiles:
          - /etc/traefik/certs/ca.crt
        clientAuthType: RequireAndVerifyClientCert