CVE-2026-85597

Critical

Description

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.

SeverityCritical

CVSS9.1

Exploit probability—

Product

Traefik

PublishedSep 4, 2026

First seenSep 4, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

traefik traefik2.11.55, 3.7.11 or later

Vendor advisories

github.com/traefik/traefik/security/advisories/GHSA-g55h-rg46-x9c5

Affected products

Product	Affected versions	Fixed in
traefik traefik	v < 2.11.55, 3.0.0 ≤ v < 3.7.11	2.11.55, 3.7.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.