Login Request a demo
High severity · published Oct 22, 2026
CVE-2026-114635
Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
New
8.7
CVSS
0.2%
EPSS
No
On KEV
Description
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
traefik · traefik
before 2.11.58; 3.0.0 before 3.7.14 · source: vendor, NVD
Affected product
TR
traefik
traefik
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114635
Vendor Advisory
https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx
Third Party Advisory
https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-sni-check-bypass-via-http-2-scheme
More from traefik
10.0
CVE-2026-54763
Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
10.0
CVE-2026-53622
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
10.0
CVE-2026-48491
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
10.0
CVE-2026-48020
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
10.0
CVE-2026-39858
Traefik: Forwarded alias spoofing top pre-auth decision bypass