CVE-2026-114656 lets an unauthenticated attacker reach a Traefik-proxied backend that is supposed to require mutual TLS client certificates, because a router rule using a negated Host() matcher (e.g. `!Host(\`secure.example.com\`)`) is miscounted as serving that host, which triggers a TLS options conflict and makes Traefik silently fall back to its default TLS options with no client-certificate requirement.
Vulnerability summary
9.3
Critical
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-22
Published
Vulnerability ID: CVE-2026-114656 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Traefik | cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | v2 through 2.11.57 (fixed in 2.11.58); v3.0.0 through 3.7.12 (fixed in 3.7.13) |
What this means
CVE-2026-114656 is an authentication bypass (CWE-436, interpretation conflict) in the Traefik reverse proxy / ingress controller. Traefik determines which TLS options apply to a given host by looking at which routers serve that host. A router rule containing a negated Host() matcher (for example !Host(\secure.example.com`), meaning "match everything except this host") is incorrectly treated by Traefik as if it serves that host. If a separate router explicitly serving that host is configured with RequireAndVerifyClientCert`, Traefik detects what looks like two different TLS option sets requested for the same host, resolves the conflict by falling back to the default TLS options, and the client-certificate requirement is silently dropped — so an unauthenticated client with no certificate at all can reach the backend (Traefik GHSA-2272-4vv8-65ww).
NVD performed its own analysis and assigned a CVSS v3.1 Primary score of 9.3 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N — network-reachable, low attack complexity, no privileges or user interaction, and a scope change because the flaw in the proxy lets an attacker affect resources beyond the proxy's own security scope. The vulnerability's original discloser, VulnCheck, rated it lower (CVSS v3.1 7.5, Secondary) assuming higher attack complexity and no scope change; the critical rating is NVD's own Primary metric (NVD).
Traefik's GitHub security advisory states the bug affects Traefik v2 up to and including 2.11.57 and v3 from 3.0.0 up to and including 3.7.12, is fixed in 2.11.58 and 3.7.13, and that setting core.strictTLSOptions=true is a workaround that disables the unsafe fallback behavior for deployments that cannot upgrade immediately (Traefik GHSA-2272-4vv8-65ww).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.00163 (5.5th percentile), consistent with a recently disclosed configuration-dependent vulnerability that requires a specific negated-matcher + mTLS setup to be exploitable and has not yet seen observed exploitation (FIRST EPSS). It is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Any deployment relying on Traefik's RequireAndVerifyClientCert TLS option alongside routers that use negated Host() matchers should upgrade to 2.11.58 / 3.7.13 or set core.strictTLSOptions=true, and should review access logs for unauthenticated requests that reached certificate-gated backends.
Evidence
- Negated Host() router matchers are incorrectly counted as served domains, causing a TLS options conflict that falls back to default TLS options and disables required client-certificate checks on that host. — Traefik GHSA-2272-4vv8-65ww
- NVD Primary CVSS v3.1 base score is 9.3 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N; the discloser (VulnCheck) Secondary score is 7.5. — NVD
- Affects Traefik v2 through 2.11.57 and v3.0.0 through 3.7.12; fixed in 2.11.58 and 3.7.13; workaround is setting core.strictTLSOptions=true. — Traefik GHSA-2272-4vv8-65ww
- EPSS score is 0.00163 (5.5th percentile) as of 2026-10-30; not listed in CISA KEV. — FIRST EPSS
