CVE-2026-85597
published 2026-09-04CVE-2026-85597: Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass…
PriorityP261critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.35%
27.6th percentile
Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | traefik-rhel9 | — | — |
| traefik | traefik | < 2.11.55 | 2.11.55 |
| traefik | traefik | >= 3.0.0 < 3.7.11 | 3.7.11 |
| traefik | traefik | 3.0.0 – 3.7.10 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/traefik/traefik: Traefik: Authentication bypass via TLS option conflict
vendor_redhat·2026-09-04·CVSS 8.2
CVE-2026-85597 [HIGH] CWE-303 github.com/traefik/traefik: Traefik: Authentication bypass via TLS option conflict
github.com/traefik/traefik: Traefik: Authentication bypass via TLS option conflict
Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.
A flaw was found in Traefik. This vulnerability allows unauthenticated attackers to bypass client-certificate authentication. By creating conflicting Transport Layer Security (TLS) options on multi-host routers, attackers can exploit shared TLS resolution acr
VulDB
Traefik up to 2.11.54 TLS Option Resolution certificate validation
vuldb·2026-09-06·CVSS 8.2
CVE-2026-85597 [HIGH] Traefik up to 2.11.54 TLS Option Resolution certificate validation
A vulnerability was found in Traefik up to 2.11.54 and classified as problematic. Impacted is an unknown function of the component TLS Option Resolution. The manipulation results in improper certificate validation.
This vulnerability is identified as CVE-2026-85597. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on
ghsa_unreviewed·2026-09-04
CVE-2026-85597 [HIGH] CWE-863 Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.
No detection rules found.
No public exploits indexed.
2026-09-04
Published