Traefik Before 2.11.58 And 3.7.13 Mtls Bypass Via Negated Host Matcher

Back www.vulncheck.com

Traefik Before 2.11.58 And 3.7.13 Mtls Bypass Via Negated Host Matcher

www.vulncheck.com • October 22, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Traefik Vulnerabilities Discovered Before Version 3.7.14 Several vulnerabilities affecting Traefik versions prior to 3.7.14 have been disclosed, including TLS config bypass via NTLM/Kerberos round tripper, identity leaks in FastProxy, SNI check bypass via HTTP/2 scheme, MTLS bypass via negated host matcher, and MTLS header spoofing via Ingress Nginx HTTP router. These vulnerabilities impact Traefik versions 2.11.0 to 2.11.58 and 3.0.0 to 3.7.14. The issues are categorized under various CWEs, including improper certificate validation and exposure of data elements to wrong sessions. The vulnerabilities are currently, and no has been reported. Organizations using affected versions are advised to prioritize updates as they become available. 43

Extracted Entities

Vulnerabilities (1)

MTLS Bypass Via Negated Host Matcher Vulnerability