PT-2026-50143 · Traefik · Traefik
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Traefik versions 3.7.0 through 3.7.2
Description
An issue in the
SNICheck domain-fronting protection allows an unauthenticated client to bypass mutual TLS (mTLS) enforced through wildcard router TLSOptions. When a router uses a wildcard host rule, such as Host("*.example.com"), with strict TLS options like RequireAndVerifyClientCert, the SNICheck middleware resolves TLS options for the HTTP Host header using only exact map lookups, failing to apply wildcard matching.An attacker can exploit this by completing a TLS handshake using a permissive SNI (Server Name Indication) available on the same entrypoint and then sending an HTTP
Host header targeting the wildcard-protected backend. This allows the request to reach the backend without presenting a required client certificate. This behavior affects the standard HTTPS and HTTP-2 paths.Recommendations
Update to version 3.7.3 or later.
As a temporary workaround, avoid using wildcard router
TLSOptions for mTLS access control.
As a temporary workaround, enumerate exact protected hostnames instead of using wildcard Host rules.
As a temporary workaround, enforce mTLS in the default TLS options.
As a temporary workaround, avoid mixing permissive and mTLS-protected hosts on the same entrypoint.
As a temporary workaround, block or reject domain-fronted requests at another network layer.Exploit
Fix
Authentication Bypass Using an Alternate Path or Channel
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Traefik