CVE-2026-114656: traefik, друго

Описание

Оригинално описание

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.

Засегнати продукти

• traefik traefik: преди 2.11.58; 2.11.58
• traefik traefik: 3.0.0 преди 3.7.13; 3.7.13

Вид слабост

• CWE-436 Конфликт при интерпретация

История

Други уязвимости в traefik traefik

• 8.2CVE-2026-119574
• 4.4CVE-2026-119573
• 8.7CVE-2026-119572
• 8.7CVE-2026-114642
• 6.3CVE-2026-114641

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-114656
• https://nvd.nist.gov/vuln/detail/CVE-2026-114656
• https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww
• https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.13-mtls-bypass-via-negated-host-matcher