Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS authentication. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.

The version of Traefik installed on the remote macOS host is prior to 2.11.41 or 3.x prior to 3.6.11. It is, therefore, affected by multiple vulnerabilities:

  - mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS     ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return     an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client     certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services     that should require mutual TLS authentication. (CVE-2026-32305)

  - BasicAuth middleware allows username enumeration via a timing attack. When a submitted username exists, the     middleware performs a bcrypt password comparison taking significantly longer than when the username does not     exist. This timing difference is observable over the network and allows an unauthenticated attacker to     reliably distinguish valid from invalid usernames. (CVE-2026-32595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 832a823b-25b5-11f1-b6f8-5404a68ad561 advisory.

    The traefik project releases a new version addressing multiple CVEs:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through
    3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to
    fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's
    SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default
    TLS configuration, which does not require client certificates by default. This allows an attacker to
    bypass route-level mTLS enforcement and access services that should require mutual TLS authentication.
    This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2. (CVE-2026-32305)

ID	Name	Product	Family	Severity
303797	Traefik < 2.11.41 / 3.x < 3.6.11 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
303310	FreeBSD : traefik -- Multiple vulnerabilities (832a823b-25b5-11f1-b6f8-5404a68ad561)	Nessus	FreeBSD Local Security Checks	high
439064	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-wvvq-wgcr-9q48)	Tenable Cloud Security	SCA Checks	high
439064	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-wvvq-wgcr-9q48)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-32305

high

Tenable Plugins

high

high

high

high