Traefik: authentication bypass

traefik

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains.

Do this now

Check the advisory for a fix and restrict access to traefik meanwhile.

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 15:18 UTC
Versions per the CVE record from VulnCheck, not the vendor: 3.7.13
2.11.58
Identifiers: CVE-2026-114656
CVSS: 9.3
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Traefik: authentication bypass
Severity: critical. Patch status: fix status unknown.
Affected: traefik
Versions per the CVE record from VulnCheck, not the vendor: 3.7.13, 2.11.58
Ids: CVE-2026-114656

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains.

## Steps
1. Search the repo, its CI and infra config for traefik. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from VulnCheck, not the vendor: traefik: 3.0.x → 3.7.13; 2.11.58. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| traefik 3.0.x | per the CVE record from VulnCheck, not the vendor | 3.7.13 | restrict network access to it |
| traefik | per the CVE record from VulnCheck, not the vendor | 2.11.58 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-114656") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/traefik/traefik/security/advisories/GHSA-2272-4vv8-65ww https://nvd.nist.gov/vuln/detail/CVE-2026-114656
https://pwned.coffee/i/traefik-authentication-bypass-cve-2026-114656

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from VulnCheck, not the vendor: Product Affected Version named Source
traefik 3.0.0 to before 3.7.13 3.7.13 CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov
traefik before 2.11.58 2.11.58 CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov
Score: CVSS 9.3 (critical). CVSS 3.1 9.3 (NVD) for CVE-2026-114656
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
traefik	3.0.0 to before 3.7.13	3.7.13	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov
traefik	before 2.11.58	2.11.58	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee