# CVE-2026-114656: Traefik authentication bypass in TLS options resolution

Source: https://junglewise.ai/threats/cve-2026-114656-traefik-before-2-11-58-and-3-7-13-contains-an-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114656 · Severity: high · CVSS 7.5 · Published 2026-10-22

Traefik is a reverse proxy that routes network traffic to backend services and enforces security policies like mutual TLS authentication. A vulnerability in how Traefik resolves TLS settings allows unauthenticated clients to bypass client-certificate authentication on protected backends. An attacker can reach sensitive services that should require valid client certificates by exploiting how negated Host matchers interact with Traefik's TLS configuration.

Technologies: [Traefik](https://junglewise.ai/threats/technologies/traefik). Vendors: [Traefik](https://junglewise.ai/threats/vendors/traefik).

## Quick answers

**Is CVE-2026-114656 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114656 being exploited in the wild.

**How severe is CVE-2026-114656?** High severity, with a CVSS score of 7.5, published 22 October 2026.

**Which products and versions are affected?** Traefik before 2.11.58 and 3.0.0 through 3.7.12.

**Is there a fix for CVE-2026-114656?** Yes: fixed in Traefik 2.11.58, 3.7.13. Until then: Set core.strictTLSOptions=true to disable the fallback to default TLS options and prevent the authentication bypass until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114656 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114656?** Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Traefik 2.11.58, 3.7.13

Set core.strictTLSOptions=true to disable the fallback to default TLS options and prevent the authentication bypass until upgrading.

## Technical details

When a router rule uses a negated Host matcher (e.g., PathPrefix(`/`) && !Host(`secure.example.com`)), Traefik incorrectly counts the negated host as served by that router, creating a TLS options conflict with other routers serving the same host. The conflicting TLS options cause Traefik to fall back to default options, which disable client-certificate verification. This affects both the v2 and v3 major versions of Traefik.

## Affected products

- Traefik Traefik before 2.11.58 and 3.0.0 through 3.7.12

## Timeline

- 2026-10-07: disclosed
- 2026-10-22: advisory

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww](https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww)
- [https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.13-mtls-bypass-via-negated-host-matcher](https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.13-mtls-bypass-via-negated-host-matcher)

## Related threats

- [Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate](https://junglewise.ai/threats/cve-2026-121966-traefik-2-x-before-2-11-60-and-3-x-before-3-7-16-sends)
- [Traefik FastProxy data race in HTTP/1 upgrades](https://junglewise.ai/threats/cve-2026-119574-traefik-from-3-2-0-before-3-7-15-contains-a-data-race-in-the)
- [Traefik NTLM/Kerberos TLS configuration bypass](https://junglewise.ai/threats/cve-2026-114642-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-stores-its)
- [Traefik authentication bypass in backend connection pool](https://junglewise.ai/threats/cve-2026-114639-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-contains)
- [Traefik Kubernetes Ingress missing namespace validation in annotations](https://junglewise.ai/threats/cve-2026-112778-traefik-before-2-11-46-3-x-before-3-6-17-and-3-7-0-lack)