CVE-2026-85597
Received Received - Intake

TLS Option Conflict Bypasses Client-Certificate Authentication in Traefik

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85597
EUVD
EUVD-2026-71020

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
traefik traefik to 2.11.55 (exc)
traefik traefik From 3.0.0 (inc) to 3.7.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Traefik before v2.11.55 has a TLS option conflict flaw where unauthenticated attackers can bypass client-certificate authentication. By creating conflicting TLS options on multi-host routers, attackers exploit shared TLS resolution across multiple hostnames in a single router rule. This causes strict mTLS requirements to fall back to default options, allowing access to protected backends.

Detection Guidance

To detect this vulnerability, check Traefik versions before v2.11.55 or v3.7.12 using commands like 'traefik version' or inspecting container tags. Look for multi-host routers with conflicting TLS options. Review logs for unauthorized access attempts or mTLS bypass events.

Impact Analysis

Unauthenticated attackers could gain unauthorized access to protected backends that rely on mTLS authentication. This could lead to data breaches, unauthorized data access, or system compromise if sensitive services are exposed.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict mTLS or client-certificate authentication for data protection. Non-compliance may result in legal penalties, fines, or loss of certification under standards like GDPR (data protection) or HIPAA (healthcare data privacy).

Mitigation Strategies

Upgrade Traefik to v2.11.55 or later, or v3.7.11 or later. Enable the 'core.strictTLSOptions' configuration to disable fallback behavior. Review and correct multi-host router TLS configurations to avoid conflicts. Remove or secure any overlapping routers with differing TLS options.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart