CVE-2026-114635

HighCVSS 8.7/10Last modified Oct 22, 2026

Description

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-288

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
traefiktraefik< 2.11.58
traefiktraefik>= 3.0.0, < 3.7.14

References

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1146368.7Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated fCVE-2026-1146378.7Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which failCVE-2026-1146388.7Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CVE-2026-1146398.7Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an AutCVE-2026-114643.1A vulnerability was identified in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file src\main\jCVE-2026-1146408.7Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards clCVE-2026-1146413.7Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, whereCVE-2026-1146428.7Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed bCVE-2026-1146435.4The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type aCVE-2026-1146445.9The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON valuCVE-2026-1146455.2A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to CVE-2026-1146466.5A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a