CVE-2026-114640High· 8.7▾ TwilightTraefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled al…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.
traefik >= 3.7.0 < 3.7.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88011High· 8.1Traefik is an open source HTTP reverse proxy and load balancer
CVE-2026-88879High· 8.2Traefik is an HTTP reverse proxy and load balancer
CVE-2026-114639High· 8.7Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
CVE-2026-114636High· 8.7Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
CVE-2026-114635High· 8.7Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
CVE-2026-114656High· 7.5Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher