UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114635

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

Severity
High 7.0
Published
22 Oct 2026
Last changed
27 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.11.58, 3.7.14
Sources
NVD

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • Every version before 2.11.58
  • From 3.0.0 before 3.7.14

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-114635
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114635