CVE-2026-85597

Traefik, a widely used reverse proxy and ingress controller, mishandles conflict resolution when TLS options are defined for routers whose rules match multiple hostnames, causing the strict client-certificate (mTLS) requirement to fall back to default TLS options for all hosts on the router. An unauthenticated remote attacker can exploit this by inducing conflicting TLS options on such a multi-host router, and the shared TLS resolution then drops the client-certificate check. As a result, the attacker can reach backends that were supposed to be protected by mutual TLS, gaining unauthorized access to those services (confidentiality impact, per the CVSS 4.0 vector). Only Traefik deployments using client-certificate authentication via TLS options on routers matching multiple hostnames are exploitable; users of Traefik 2.x before 2.11.55 and 3.0.0 through 3.7.10 are affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and its EPSS score (0.2%) suggests exploitation is currently unlikely but not ruled out.

What to do: Upgrade 2.x deployments to 2.11.55 or later and 3.x deployments to a release newer than 3.7.10. As an interim mitigation, audit TLS options for conflicts, split multi-host router rules into per-host routers so the strict TLS option applies where required, and restrict who can modify dynamic TLS configuration. After patching, verify that client-certificate enforcement is active and review access logs for backend requests that lacked a valid client certificate.