CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict
Attackers can bypass mTLS authentication on Traefik by exploiting TLS option conflicts in multi-host routers, gaining unauthorized access to protected backends.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-85597?
CVE-2026-85597 is a high-severity authentication bypass vulnerability in Traefik Traefik, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.
Weakness: CWE-863
Which versions are affected by CVE-2026-85597?
It affects 1 product.
Products include Traefik Traefik.
How do I fix CVE-2026-85597?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-85597 being exploited?
There is no known exploitation of CVE-2026-85597 in the wild and no public exploit code.
Other vulnerabilities in Traefik Traefik
- CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Sources
Also known as GHSA-g55h-rg46-x9c5, GHSA-q42x-32f8-m4r5, MINI-ggcv-g4pv-h9f6, MINI-h755-cqvw-39pq, MINI-jp4p-wxqv-9hhw.