CVE-2026-114635

high

Description

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

References

Advisories
More

https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-sni-check-bypass-via-http-2-scheme

https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107890

Details

Source: Mitre, NVD

Published: 2026-10-22

Updated: 2026-10-27

Risk Information

CVSS v2

Base Score: 7.1

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 8.7

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Severity: High

CVSS v4

Base Score: 7

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Severity: High

EPSS

EPSS: 0.00188