PT-2026-26601 · Traefik · Traefik

Infinityhub123 · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-32305

Positive Technologies (AI Summary)

CVSS v4.0

7.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.40 and below Traefik versions 3.0.0-beta1 through 3.6.11 Traefik version 3.7.0-ea.1

Description Traefik, an HTTP reverse proxy and load balancer, is susceptible to a mutual TLS (mTLS) bypass. This occurs due to a flaw in the TLS SNI pre-sniffing logic when handling fragmented ClientHello packets. When a TLS ClientHello is fragmented, Traefik's SNI extraction can fail, causing it to revert to a default TLS configuration that does not require client certificates. This allows an attacker to circumvent route-level mTLS enforcement and access services intended to be protected by mutual TLS authentication. The issue arises from a mismatch between when Traefik determines the TLS policy per host and when Go TLS parses the complete ClientHello. Specifically, the pre-sniff logic only peeks at a limited portion of the fragmented ClientHello, potentially missing the SNI and defaulting to a permissive configuration.

Recommendations Traefik versions prior to 2.11.41 are vulnerable. Traefik versions 3.0.0-beta1 through 3.6.11 are vulnerable. Traefik version 3.7.0-ea.1 is vulnerable.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-1188

Related Identifiers

CVE-2026-32305

GHSA-WVVQ-WGCR-9Q48

GO-2026-4793

OPENSUSE-SU-2026:10444-1

OPENSUSE-SU-2026:10445-1

SUSE-SU-2026:1135-1

Affected Products

Traefik

References · 154

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32305.json · Exploit
• https://github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32305 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10444-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32305 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10445-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wvvq-wgcr-9q48 · Vendor Advisory
• https://github.com/traefik/traefik · Note
• https://github.com/traefik/traefik/releases/tag/v3.6.11 · Note
• https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2 · Note
• https://github.com/traefik/traefik/releases/tag/v2.11.41 · Note
• https://suse.com/security/cve/CVE-2026-33622 · Note
• https://suse.com/security/cve/CVE-2026-32937 · Note