# CVE-2026-114635: Traefik authentication bypass in SNI check via HTTP/2

Source: https://junglewise.ai/threats/cve-2026-114635-traefik-before-v2-11-58-and-v3-7-14-contains-an-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114635 · Severity: high · CVSS 8.7 · Published 2026-10-22

Traefik is a reverse proxy and load balancer that routes network traffic to backend services. An unauthenticated attacker can bypass client certificate authentication by sending specially crafted HTTP/2 requests over TLS connections, allowing them to reach protected services without presenting valid credentials. This vulnerability affects Traefik instances built with Go 1.27, potentially exposing sensitive backend systems and data.

Technologies: [Traefik Labs Traefik](https://junglewise.ai/threats/technologies/traefik-labs-traefik). Vendors: [Traefik Labs](https://junglewise.ai/threats/vendors/traefik-labs).

## Quick answers

**Is CVE-2026-114635 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114635 being exploited in the wild.

**How severe is CVE-2026-114635?** High severity, with a CVSS score of 8.7, published 22 October 2026.

**Which products and versions are affected?** Traefik Labs Traefik v2 before v2.11.58, v3.0.0 to v3.7.13.

**Is there a fix for CVE-2026-114635?** Yes: fixed in Traefik v2.11.58, v3.7.14. Until then: Official Traefik binaries and container images built with Go 1.26 are not affected; only verify your build was not compiled with Go 1.27. For Traefik v3 versions below v3.7, upgrade to a maintained patched version as no backport is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114635 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-114635?** Check whether you run Traefik Labs Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Traefik v2.11.58, v3.7.14

Official Traefik binaries and container images built with Go 1.26 are not affected; only verify your build was not compiled with Go 1.27. For Traefik v3 versions below v3.7, upgrade to a maintained patched version as no backport is available.

## Technical details

The SNI (Server Name Indication) check in Traefik, which validates that TLS connection properties match router requirements, is skipped when request TLS state is nil. Traefik built with Go 1.27 sets TLS state to nil for HTTP/2 requests with :scheme http pseudo-header sent over TLS connections, bypassing the authentication check. An unauthenticated client can exploit this to reach routers requiring client certificates without presenting one.

## Affected products

- Traefik Labs Traefik v2 before v2.11.58, v3.0.0 to v3.7.13

## Timeline

- 2026-10-07: disclosed: GitHub security advisory published
- 2026-10-21: advisory
- 2026-10-22: patched: v2.11.58 and v3.7.14 released

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx](https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx)
- [https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-sni-check-bypass-via-http-2-scheme](https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-sni-check-bypass-via-http-2-scheme)

## Related threats

- [Traefik authorization bypass in Kubernetes Ingress NGINX provider](https://junglewise.ai/threats/cve-2026-119573-traefik-3-7-11-before-3-7-15-contains-an-authorization-bypass-in)
- [Traefik ingress-nginx provider mTLS authentication bypass](https://junglewise.ai/threats/cve-2026-119572-traefik-from-3-7-0-ea-1-before-3-7-15-contains-an-authentication)
- [Traefik Ingress-NGINX mTLS identity spoofing via forged headers](https://junglewise.ai/threats/cve-2026-114640-traefik-from-v3-7-0-before-v3-7-14-contains-an-authentication)
- [Traefik Kubernetes Ingress NGINX provider authentication bypass via TLS secret name collision](https://junglewise.ai/threats/cve-2026-114638-traefik-v3-7-0-before-v3-7-14-contains-an-improper)
- [Traefik FastProxy NTLM/Negotiate authentication bypass in connection pool](https://junglewise.ai/threats/cve-2026-114637-traefik-from-v3-2-0-before-v3-7-14-contains-an-authentication)