CVE-2026-85597: Traefik TLS Auth Bypass Vulnerability

CVE-2026-85597 Overview

CVE-2026-85597 is an authorization vulnerability in the Traefik reverse proxy and load balancer. Affected releases include Traefik versions before v2.11.55 and v3.0.0 through v3.7.10. The flaw allows unauthenticated attackers to bypass client-certificate authentication (mTLS) on multi-host routers by creating conflicting TLS options. When two routers define different TLS options for hostnames sharing a router rule, Traefik falls back to the default TLS configuration for all hosts. This fallback removes the strict mTLS requirement and exposes protected backends. The issue is classified under [CWE-863] Incorrect Authorization.

Critical Impact
Unauthenticated network attackers can reach mTLS-protected backends by crafting conflicting TLS options across multi-host router rules.

Affected Products

Traefik versions prior to v2.11.55
Traefik v3.0.0 through v3.7.10
Deployments using multi-host routers with strict mTLS TLS options

Discovery Timeline

2026-09-04 - CVE-2026-85597 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85597

Vulnerability Analysis

Traefik allows operators to attach TLS options — including strict client-certificate verification — to routers matched by Server Name Indication (SNI) hostnames. When multiple routers share hostnames within a single rule, Traefik must resolve which TLS option applies at connection time. The resolution logic treats conflicting TLS option references across the same hostname set as unresolvable. Instead of failing closed, Traefik falls back to default TLS options for the affected hostnames. Any mTLS enforcement declared on the original router is silently dropped for connections matching that SNI. Attackers can then complete TLS handshakes without presenting a valid client certificate and reach the protected backend.

Root Cause

The root cause is an authorization decision that fails open during TLS option conflict resolution. Traefik prioritizes availability over strict enforcement when two router definitions disagree on TLS options for shared hostnames. The mTLS constraint is treated as an overridable preference rather than a mandatory security control. This behavior contradicts the operator's declared intent for the protected router.

Attack Vector

Exploitation requires the attacker to influence router configuration or to leverage an existing multi-host router where a second router references overlapping hostnames with different TLS options. Once the conflict exists, any network client can connect to the target hostname over TLS. The client omits the client certificate and completes the handshake using the default TLS options. Requests then reach the backend service without authentication. No credentials, user interaction, or privileged access are required at the network layer.

The vulnerability manifests in Traefik's TLS option resolution path for router rules containing multiple SNI hosts. See the GitHub Security Advisory and the VulnCheck Advisory for Traefik for the reference configuration and resolution behavior.

Detection Methods for CVE-2026-85597

Indicators of Compromise

Backend access logs showing successful requests to mTLS-protected routes without a corresponding client certificate identifier.
Traefik configuration containing two or more routers with overlapping SNI hostnames but different tls.options references.
Warnings or informational entries from Traefik indicating TLS options could not be resolved for a hostname.

Detection Strategies

Audit dynamic and static Traefik configuration for router rules that combine multiple hostnames and reference TLS option sets requiring clientAuth.clientAuthType: RequireAndVerifyClientCert.
Compare TLS options attached to each hostname across the router set and flag any hostname referenced by conflicting options.
Correlate TLS handshake telemetry with expected client certificate subjects on protected virtual hosts.

Monitoring Recommendations

Enable Traefik access logs with TLS client certificate fields and alert on connections to protected hosts that lack certificate metadata.
Forward Traefik logs and configuration change events to a centralized SIEM for continuous review.
Monitor for configuration drift where new routers are added that reuse hostnames already governed by strict mTLS options.

How to Mitigate CVE-2026-85597

Immediate Actions Required

Upgrade Traefik to v2.11.55 or v3.7.11 or later, per the maintainer advisory.
Inventory all router rules containing multiple SNI hostnames and remove conflicting TLS option references.
Restrict who can push dynamic configuration to Traefik providers such as Kubernetes CRDs, file providers, or Consul.

Patch Information

The Traefik maintainers addressed the issue in Traefik v2.11.55 and in the v3.7.x branch after v3.7.10. Refer to the GitHub Security Advisory GHSA-g55h-rg46-x9c5 for fixed version identifiers and release notes.

Workarounds

Split multi-host routers into separate router definitions, one per hostname, so TLS option resolution is unambiguous.
Apply the strict mTLS TLS option consistently across every router that references a shared hostname.
Place an additional enforcement layer, such as a service mesh sidecar or backend-side mTLS termination, in front of sensitive services until the patch is deployed.

bash

# Configuration example: enforce a single, consistent TLS options set per host
# traefik dynamic config (YAML)
tls:
  options:
    strict-mtls:
      clientAuth:
        clientAuthType: RequireAndVerifyClientCert
        caFiles:
          - /etc/traefik/certs/ca.pem

http:
  routers:
    secure-api:
      rule: "Host(`api.example.com`)"
      service: api-backend
      tls:
        options: strict-mtls