{"cve":"CVE-2026-32305","nvd":{"published":"2026-03-20T11:18:02.360","modified":"2026-07-15T02:19:58.587","status":"Modified","description":"Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS authentication. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7.8},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-287","CWE-1188","CWE-179"],"references":["https://github.com/traefik/traefik/releases/tag/v2.11.41","https://github.com/traefik/traefik/releases/tag/v3.6.11","https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2","https://github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48","https://access.redhat.com/errata/RHSA-2026:10175"],"products":["traefik:traefik"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-32305","score":0.0042,"percentile":0.3639,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-wvvq-wgcr-9q48","url":"https://osv.dev/vulnerability/GHSA-wvvq-wgcr-9q48","summary":"Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config","modified":"2026-04-16T02:14:29.818337429Z","packages":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","purl":"pkg:golang/github.com/traefik/traefik/v3","ranges":[">=3.7.0-ea.1 <3.7.0-ea.2"],"fixed":["3.7.0-ea.2"]},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","purl":"pkg:golang/github.com/traefik/traefik/v3","ranges":["<3.6.11"],"fixed":["3.6.11"]},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","purl":"pkg:golang/github.com/traefik/traefik/v2","ranges":["<2.11.41"],"fixed":["2.11.41"]},{"ecosystem":"Go","name":"github.com/traefik/traefik","purl":"pkg:golang/github.com/traefik/traefik","ranges":["<=1.7.34"],"fixed":[]}]},{"id":"GO-2026-4793","url":"https://osv.dev/vulnerability/GO-2026-4793","summary":"Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config in github.com/traefik/traefik","modified":"2026-04-16T02:14:32.775052779Z","packages":[{"ecosystem":"Go","name":"github.com/traefik/traefik","purl":"pkg:golang/github.com/traefik/traefik","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","purl":"pkg:golang/github.com/traefik/traefik/v2","ranges":["<2.11.41"],"fixed":["2.11.41"]},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","purl":"pkg:golang/github.com/traefik/traefik/v3","ranges":["<3.6.11",">=3.7.0-ea.1 <3.7.0-ea.2"],"fixed":["3.6.11","3.7.0-ea.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}