CVE-2026-114635 in Traefikinfo

Summary

by MITRE • 10/22/2026

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulnCheck

Reservation

10/21/2026

Disclosure

10/22/2026

Moderation

accepted

EPSS

0.00000

KEV

no

Activities

low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-114635
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-114635
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-114635/

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!