Is CVE-2026-114635 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114635 being exploited in the wild.

How severe is CVE-2026-114635?

High severity, with a CVSS score of 8.7, published 22 October 2026.

Which products and versions are affected?

Traefik Labs Traefik v2 before v2.11.58, v3.0.0 to v3.7.13.

How is CVE-2026-114635 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114635?

Check whether you run Traefik Labs Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114635: Traefik authentication bypass in SNI check via HTTP/2

CVE-2026-114635 · Severity: high · CVSS 8.7 · Published 2026-10-22

Traefik is a reverse proxy and load balancer that routes network traffic to backend services. An unauthenticated attacker can bypass client certificate authentication by sending specially crafted HTTP/2 requests over TLS connections, allowing them to reach protected services without presenting valid credentials. This vulnerability affects Traefik instances built with Go 1.27, potentially exposing sensitive backend systems and data.

Technologies: Traefik Labs Traefik. Vendors: Traefik Labs.

Quick answers

Is CVE-2026-114635 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114635 being exploited in the wild.
How severe is CVE-2026-114635?: High severity, with a CVSS score of 8.7, published 22 October 2026.
Which products and versions are affected?: Traefik Labs Traefik v2 before v2.11.58, v3.0.0 to v3.7.13.
Is there a fix for CVE-2026-114635?: Yes: fixed in Traefik v2.11.58, v3.7.14. Until then: Official Traefik binaries and container images built with Go 1.26 are not affected; only verify your build was not compiled with Go 1.27. For Traefik v3 versions below v3.7, upgrade to a maintained patched version as no backport is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114635 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114635?: Check whether you run Traefik Labs Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Traefik v2.11.58, v3.7.14

Official Traefik binaries and container images built with Go 1.26 are not affected; only verify your build was not compiled with Go 1.27. For Traefik v3 versions below v3.7, upgrade to a maintained patched version as no backport is available.

Technical details

The SNI (Server Name Indication) check in Traefik, which validates that TLS connection properties match router requirements, is skipped when request TLS state is nil. Traefik built with Go 1.27 sets TLS state to nil for HTTP/2 requests with :scheme http pseudo-header sent over TLS connections, bypassing the authentication check. An unauthenticated client can exploit this to reach routers requiring client certificates without presenting one.

Affected products

Traefik Labs Traefik v2 before v2.11.58, v3.0.0 to v3.7.13

Timeline

2026-10-07: disclosed: GitHub security advisory published
2026-10-21: advisory
2026-10-22: patched: v2.11.58 and v3.7.14 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.