Описание
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
A flaw was found in Traefik. An authentication bypass vulnerability allows an unauthenticated remote attacker to bypass client certificate verification and access protected backend systems. This issue occurs when routing rules using negated host matchers create a Transport Layer Security (TLS) configuration conflict, causing the server to fall back to default settings that do not enforce client certificates. Consequently, an attacker can connect to services that should require authentication without presenting a valid certificate.
Отчет
Red Hat has evaluated this vulnerability as Important rather than Critical because successful exploitation requires a specific, non-default configuration combining negated host matchers with mutual TLS authentication, which inadvertently triggers a fallback to insecure default settings. While an unauthenticated remote attacker could exploit this condition to bypass client certificate validation and reach sensitive internal backend services, Traefik is not packaged or distributed in Red Hat Enterprise Linux. Consequently, standard Red Hat enterprise environments are not exposed to this flaw under default installations.
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vu ...
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
ALT-PU-2026-15593: package `traefik` update to version 3.7.13-alt1
EPSS
7.5 High
CVSS3