CVE-2026-32305: Traefik mTLS bypass via fragmented ClientHello SNI extraction failure
Vulnerability summary
CVE-2026-32305 is a high (CVSS 8.3) Improper Authentication vulnerability in traefik. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.4% of scored vulnerabilities.
Severe, CVSS 7.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 20-03-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS authentication. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · GoEcosystem advisory · calculated7.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- NVDNIST7.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 0.47% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-1188Initialization of a Resource with an Insecure DefaultThe product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
- CWE-179Incorrect Behavior Order: Early ValidationThe product validates input before applying protection mechanisms that modify the input.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard2 products
- traefik-3.5All versions (No fix recorded)
- traefik-fips-3.5All versions (No fix recorded)
Github.com/traefik/traefik2 products
- v2< 2.11.41
- v3< 3.6.11 | ≥ 3.7.0-ea.1, < 3.7.0-ea.2
Github.com/traefik1 product
- traefik≤ 1.7.34 | All versions (No fix recorded)
Traefik1 product
- traefik≥ 3.0.0-beta1, < 3.6.11 | ≥ 3.7.0-ea.1, < 3.7.0-ea.2 | < 2.11.41 | ≥ 3.0.0, ≤ 3.6.11 | 3.7.0:ea1
4 vendors · 6 products
References
12 links- github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48X Refsource CONFIRMWEBAdvisoryPatchVendor Advisory
Show all 12 references
- github.com/traefik/traefikPACKAGE