CVE-2026-32305: Traefik mTLS Bypass Vulnerability

CVE-2026-32305 Overview

CVE-2026-32305 is an authentication bypass vulnerability in Traefik, the popular HTTP reverse proxy and load balancer. The vulnerability allows attackers to bypass mutual TLS (mTLS) enforcement through a flaw in the TLS Server Name Indication (SNI) pre-sniffing logic when handling fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI, causing the TCP router to fall back to default TLS configuration which does not require client certificates.

Critical Impact

Attackers can bypass route-level mTLS enforcement and access backend services that should require mutual TLS authentication, potentially exposing sensitive internal services to unauthorized access.

Affected Products

• Traefik versions 2.11.40 and below
• Traefik versions 3.0.0-beta1 through 3.6.10
• Traefik version 3.7.0-ea.1

Discovery Timeline

• 2026-03-20 - CVE-2026-32305 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32305

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287) exists in Traefik's TLS SNI pre-sniffing mechanism. The flaw occurs when processing fragmented TLS ClientHello messages, which is a legitimate TLS behavior where the initial handshake can be split across multiple TLS records.

When Traefik attempts to extract the SNI from a fragmented ClientHello, the extraction logic encounters an EOF condition before completing the SNI parsing. Rather than rejecting the connection or requiring complete SNI information, Traefik returns an empty SNI value. The TCP router then uses this empty SNI to match routes, ultimately falling back to the default TLS configuration.

The critical security issue is that the default TLS configuration does not enforce client certificate requirements. This means connections that should be authenticated via mTLS are instead allowed through without any client certificate verification, completely bypassing the intended authentication mechanism.

Root Cause

The root cause lies in insufficient error handling within Traefik's SNI extraction logic when processing TLS ClientHello packets that span multiple TLS records. The code fails to properly handle the EOF condition that occurs when reading a fragmented handshake, treating it as a valid case with an empty SNI rather than an error condition requiring connection termination or additional data buffering.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious TLS client that deliberately fragments the ClientHello message across multiple TLS records. By doing so, the attacker triggers the EOF condition in Traefik's SNI extraction, causing the proxy to use the default TLS configuration that does not require client certificates. This allows the attacker to establish a connection to backend services that would normally require mTLS authentication.

The attack is network-accessible and requires no authentication or user interaction, making it exploitable by any attacker who can reach the Traefik instance over the network. Services intended to be protected by mTLS become accessible to unauthorized parties who can craft the appropriate fragmented TLS handshake.

Detection Methods for CVE-2026-32305

Indicators of Compromise

• TLS connections to mTLS-protected routes that lack client certificate verification in access logs
• Unusual patterns of connections with empty or missing SNI values in Traefik logs
• Access to mTLS-protected services from clients that should not have valid client certificates

Detection Strategies

• Monitor Traefik access logs for connections to mTLS-protected routes without corresponding client certificate information
• Implement network-level monitoring to detect TLS handshakes with fragmented ClientHello packets targeting Traefik instances
• Review authentication logs on backend services for unexpected access patterns that bypass expected mTLS enforcement

Monitoring Recommendations

• Enable verbose TLS debugging in Traefik to log SNI extraction failures and fallback behavior
• Implement alerting for connections that reach mTLS-protected backends without valid client certificates
• Monitor for unusual traffic patterns targeting your Traefik reverse proxy infrastructure

How to Mitigate CVE-2026-32305

Immediate Actions Required

• Upgrade Traefik to patched versions: v2.11.41, v3.6.11, or v3.7.0-ea.2
• Review access logs for any signs of exploitation targeting mTLS-protected services
• Temporarily implement network-level controls to restrict access to sensitive services if immediate patching is not possible
• Audit backend service access controls to ensure defense-in-depth beyond mTLS

Patch Information

Traefik has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• Version 2.x: Upgrade to v2.11.41
• Version 3.6.x: Upgrade to v3.6.11
• Version 3.7.x Early Access: Upgrade to v3.7.0-ea.2

For detailed information about the vulnerability, refer to the GitHub Security Advisory GHSA-wvvq-wgcr-9q48.

Workarounds

• Implement network segmentation to limit access to Traefik instances serving mTLS-protected routes
• Configure additional authentication layers on backend services as defense-in-depth measures
• Use a Web Application Firewall (WAF) or network security appliance to inspect TLS handshakes for anomalous fragmentation patterns

# Example: Update Traefik using Docker
docker pull traefik:v2.11.41
# or for v3.x
docker pull traefik:v3.6.11

# Restart your Traefik container with the updated image
docker-compose down && docker-compose up -d