Description
Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| traefik | traefik | < 2.11.55, 3.0.0 – ≤ 3.7.10 | 2.11.55 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | traefik-3.6 | No fix yet | — |
References
- GitHub Security Advisory (GHSA-g55h-rg46-x9c5) vendor-advisory
- VulnCheck Advisory: Traefik before v2.11.55 mTLS Bypass via TLS Option Conflict third-party-advisory