CVE-2026-32305highCWE-1188CWE-179CWE-287

CVE-2026-32305: fallo de gravedad alta en traefik

Traefik mTLS bypass via fragmented ClientHello SNI extraction failure

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear traefik+ Monitorear github.com/traefik/traefik

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.8epss 0.4%
Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS authentication. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Productos afectados
traefik · traefik
CVEs relacionadas — traefik

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-85595CRITICALTraefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuthEPSS 2.5%CVE-2022-23632HIGHTraefik skips the router TLS configuration when the host header is an FQDNEPSS 1.7%CVE-2024-45410CRITICALHTTP client can remove the X-Forwarded headers in TraefikEPSS 1.5%CVE-2025-54386HIGHTraefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code ExecutionEPSS 1.4%CVE-2022-39271HIGHTraefik HTTP/2 connections management could cause a denial of serviceEPSS 1.4%CVE-2023-47633HIGHUncontrolled Resource Consumption in TraefikEPSS 1.3%