CVE-2026-85597

CVE-2026-85597 — Traefik TLS Option Conflict Resolution mTLS Bypass

Executive Summary

CVE-2026-85597 is a TLS option conflict resolution vulnerability in Traefik, an open-source edge router and reverse proxy, affecting versions prior to v2.11.55. The flaw allows unauthenticated attackers to completely bypass client-certificate (mutual TLS/mTLS) authentication on multi-host routers by creating conflicting TLS options. Because Traefik resolves shared TLS configuration across multiple hostnames within a single router rule, a strict mTLS requirement can fall back to insecure default options, giving attackers access to backend services that should be protected by certificate-based authentication. The vulnerability is currently unpatched with no public exploit or vendor fix; however, the severity is high given Traefik's widespread deployment at network perimeter and the authentication bypass impact.

Technical Analysis

The vulnerability resides in Traefik's TLS option conflict resolution logic. In Traefik, routers route inbound requests to backend services based on rules that match hostnames, paths, and other criteria. Each router can be assigned specific TLS options that define SSL/TLS behavior, including whether client-certificate authentication is enforced.

According to the NVD description, the flaw is present in versions before v2.11.55. Traefik allows a single router rule to match multiple hostnames. When conflicting TLS options are defined across these hosts, Traefik's configuration resolution process mishandles the conflict. Specifically, when multiple hosts in a single router rule share a TLS configuration resolution path, the presence of contradictory TLS option definitions can cause the enforcement engine to silently revert to default TLS options. Since Traefik's default TLS options do not enforce client-certificate validation, the strict mTLS mode required by the intended configuration is discarded.

The attack is entirely unauthenticated. An attacker need not possess a valid client certificate, nor any credentials, to exploit the misconfiguration. The flaw is triggered by the way Traefik reconciles TLS configurations at the router level—not by any malformed input. The vulnerability class is CWE-863 (Incorrect Authorization), because the effective result is that authentication checks (client-certificate verification) are not applied, which constitutes an authorization bypass.

Technical details on the precise internal resolution logic, function names, or configuration entry points are not disclosed in the NVD description. The flaw is best understood as a logic error in configuration precedence handling: when a router matches multiple hosts with differing TLS options, Traefik fails to enforce the most restrictive option set and instead falls back to defaults for all hosts. This indicates a lack of proper validation or conflict detection in the TLS option merging algorithm. The security impact is only realized in deployments where: (1) multiple hostnames are mapped through a single router rule, and (2) at least one of those hosts is intended to require mTLS authentication.

No CVSS vector, EPSS score, or CISA KEV entry is available for this vulnerability at the time of writing.

Exploitation Scenarios

No public PoC exists, and no exploit code has been released. The attack chain described below is inferred from the vulnerability class and the NVD description. Attackers would target organizations that expose Traefik as an edge router or reverse proxy with multi-host routers enforcing mTLS on backend services.

Step 1: Reconnaissance/Target Identification The attacker identifies Traefik instances exposed to the internet. Traefik often is not directly branded in HTTP headers; however, version-specific behavior, the presence of the Traefik dashboard (if enabled), or specific error pages can reveal the software. Shodan queries such as product:"Traefik" or http.title:"Traefik" may surface instances. The attacker then probes configurations by testing multiple virtual hosts on a single IP address. The target environment must have a router rule configured that matches at least two hostnames, where at least one requires mTLS.

Step 2: Triggering the Flaw The attacker does not send malicious requests to trigger the flaw. Instead, the vulnerability is a configuration-resolution bug. The attacker abuses the already-existing misconfiguration. Because the router rule matches multiple hosts with conflicting TLS options, Traefik has already resolved the TLS configuration to fall back to defaults (no client-certificate requirement) for all hosts. The attacker merely sends ordinary HTTP/S requests to one of the protected hostnames (the one intended to require mTLS). No special payload or forging of client certificates is needed.

Step 3: Execution Method The attacker issues a standard request (e.g., GET /protected-resource HTTP/1.1 with Host: internal-admin.example.com) to the target. Because the mTLS requirement has been downgraded to default TLS options, Traefik forwards the request to the backend without performing client-certificate validation. The authentication layer at the edge is entirely bypassed. Any backend authentication that relies on the edge performing client-certificate checks is also bypassed unless separately enforced.

Step 4: Post-Exploitation Impact Once the attacker reaches the protected backend, the impact depends on what the backend exposes. Traefik is commonly used to front internal admin panels, APIs, microservices, and CI/CD systems. Successful exploitation provides the attacker unauthenticated access to these resources. Because the attacker bypasses the edge authentication, credentials are not required. Post-exploitation activities could include data exfiltration, lateral movement within internal networks reachable from the backend, privilege escalation via exposed administrative functions, or service disruption.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the description of the TLS option conflict.

Impact Assessment

The primary impact is the complete bypass of mutual TLS authentication, a security control designed to ensure only clients possessing valid certificates may reach protected infrastructure. This is a high-severity authentication bypass in a perimeter component.

• Confidentiality Impact: High. Sensitive data behind mTLS-protected routes can be read by any attacker able to reach the Traefik instance.
• Integrity Impact: High. Attackers can potentially modify data, submit API requests, or trigger state changes through the unprotected backends.
• Availability Impact: Low to Medium. While the flaw itself is not geared toward DoS, downstream abuse of exposed services could disrupt operations.
• Attack Complexity: Low. The attacker simply sends standard requests to a misconfigured host; no special tooling or crafting is required.
• Privileges Required: None. Unauthenticated exploitation.
• User Interaction: None.

The blast radius is significant given Traefik's deployment profile. It is widely used in Kubernetes environments (as an ingress controller), Docker deployments, and as a standalone reverse proxy. The specific conditions (multi-host router with conflicting TLS options) may reduce the population of affected deployments, but organizations using mTLS across multiple hostnames in a single router are likely compliant with common patterns.

There is currently no CVSS score assigned, which prevents exact severity quantification. However, based on the authentication bypass nature and edge positioning, a conservative estimate places this in the Critical severity range (CVSS 9.0+), subject to the specific deployment conditions.

Detection Guidance

Sigma Rule

title: Traefik mTLS Bypass via TLS Option Conflict
id: 9a0b5f2a-4f6d-4c93-9d2e-5b0c2f91a7c3
status: experimental
description: Detects requests to Traefik backend services that may indicate mTLS authentication bypass, focusing on hosts expected to enforce client-certificate authentication.
author: ValtersIT Threat Intelligence Team
logsource:
  category: webserver
  product: traefik
detection:
  selection:
    # Requests to hosts typically behind mTLS
    http.hostname|startswith:
      - 'internal'
      - 'admin'
      - 'management'
    # Presence of a valid client certificate is absent (TLS handshake without cert)
    http.connection.tls_certificate|contains: null
  condition: selection
  timeframe: 5m
level: high
falsepositives:
  - Legitimate administrative traffic from whitelisted tools not using client certs
  - Misconfigured internal monitoring systems
fields:
  - src_ip
  - http.hostname
  - http.url
  - user_agent

YARA Rule

rule Traefik_mTLS_Bypass_Config_Indicator {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects Traefik configuration files or logs indicating conflicting TLS options and mTLS fallback patterns"
        date = "2026-01-15"
    strings:
        // Log entries indicating TLS option fallback or misconfiguration
        $log1 = "tls option" ascii wide
        $log2 = "certificat" ascii wide nocase
        $log3 = "mutual" ascii wide nocase
        $log4 = "skip" ascii wide nocase
        $log5 = "mTLS" ascii wide nocase
        // Configuration keys for TLS options in Traefik
        $config1 = "tlsOptions" ascii wide
        $config2 = "clientAuth" ascii wide
        $config3 = "router" ascii wide
    condition:
        any of ($log*) and any of ($config*)
}

Suricata IDS Rule

alert tls any any -> any 443 (msg:"Traefik Potential mTLS Bypass - Client Certificate Not Requested"; flow:to_server,established; tls.cert_not_after; tls.store; tls.certs_len:0; content:"Host:"; nocase; http.host; http.request_line; sid:2026085597; rev:1; metadata:created_at 2026-01-15, updated_at 2026-01-15, cve CVE-2026-85597)

Note: This rule is framework-level and may produce high false positives. Suricata's TLS and HTTP inspectors must be enabled. The rule flags TLS handshakes to port 443 (common Traefik listener) where the client does not present a certificate (tls.certs_len:0) and where an HTTP Host header is present—an indicator that a client is connecting without a client cert to a service that plausibly should require one.

Elastic Detection

sequence by host.name, destination.ip with maxspan=10m
  [ network where event.category == "network" and destination.port == 443 and
    network.protocol == "tls" and not any where process.name == "curl" ]
  [ http where event.category == "http" and http.request.method == "GET" and
    // Adjust for expected mTLS-protected endpoints
    http.request.referer == null and
    // Example: internal admin paths
    wildcard(http.request.uri, "*/admin/*", "*/internal/*", "*/api/private*")
  ]

This EQL sequence detects a TLS connection without significant client certificate negotiation followed immediately by HTTP requests to sensitive paths, potentially indicating an mTLS-authenticated route being accessed without a certificate.

Splunk SPL Query

index=proxy OR index=webserver sourcetype=traefik:access
| where like(lower(host), "%admin%") OR like(lower(uri), "%internal%")
| where NOT like(ssl_cipher, "%certificate%")
| stats count by src_ip, host, uri, _time
| sort - count

This SPL query looks for access logs referencing internal hosts or URIs typically behind mTLS, where the log does not indicate a client certificate was presented. Traefik access logs may include TLS client certificate metadata depending on forwarded headers.

Wazuh OSSEC Rule

<group name="traefik,">
  <rule id="100855" level="12">
    <decoded_as>json</decoded_as>
    <field name="host">\.(internal|admin|management)\.</field>
    <field name="certificate_present">false</field>
    <description>Possible mTLS bypass detected: Request to internal host without client certificate</description>
    <group>authentication_failure,traefik</group>
  </rule>
</group>

This rule will require Traefik logs to be parsed into JSON and contain the fields host and certificate_present. Wazuh integration with Traefik would need to be configured to populate these fields from parser config.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No vendor advisory, patch reference, or fix version has been confirmed in any tracked source. The NVD description indicates the fix is in v2.11.55, but this has not been corroborated by vendor archives, and no official patch notes exist. Treat this as unpatched.

1) Immediate Mitigations:

• Review Router Configurations: Audit all Traefik router definitions. Identify any router rule that matches multiple hostnames (e.g., using Host() with OR logic) where different hosts have conflicting TLS options. Split these into separate router definitions, each with its own explicit TLS options.
• Enforce TLS Options per Host: Reconfigure routers so that each hostname requiring mTLS has a dedicated router or an unambiguous TLS options reference. Avoid mixing hosts with and without mTLS in the same rule.
• Remove Conflicting TLS Options: Where possible, remove any TLS option definitions that are not explicitly required, reducing the chance of resolution fallback.
• Layered Authentication: If backend services require stronger assurance, enable additional authentication layers at the application level (e.g., OAuth, API keys) to reduce reliance on edge-level mTLS only.

2) Patch/Upgrade Steps:

• Monitor the Traefik GitHub repository and official release channels for v2.11.55 or later. When released, upgrade Traefik to the patched version. Traefik is typically deployed as a container; pull the new image and restart the reverse proxy service.
• Test the upgrade in a staging environment that replicates the vulnerable multi-host configuration to confirm the mTLS enforcement is restored.
• If direct upgrade is disruptive, backport configuration validation logic or use a web application firewall (WAF) in front of Traefik to enforce client-certificate checks as a temporary compensating control.

3) Long-Term Hardening:

• Implement a Configuration-as-Code pipeline with automated validation that rejects router definitions with ambiguous TLS options.
• Use dedicated routers per hostname where mTLS is a security boundary.
• Regularly audit edge proxy configurations against internal security standards.
• Maintain visibility into access patterns to detect anomalous traffic bypassing intended authentication layers.

References

1. NVD Reference — https://nvd.nist.gov/vuln/detail/CVE-2026-85597
2. Traefik Official Documentation — TLS Options Configuration — https://doc.traefik.io/traefik/routing/routers/#tls-options
3. MITRE CWE-863 — Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no entry for this CVE)

Threat Actor Activity: No evidence of in-the-wild exploitation, public PoC, or threat actor campaigns has been identified as of the analysis date. The vulnerability is assumed to be of interest to attackers targeting edge infrastructure, but active exploitation has not been confirmed. Monitoring for configuration-focused scanning activity around Traefik deployments is recommended.