CVE-2026-114635

8.7 HIGHpublic exploit available

Published 2026-10-22 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weaknesses

CWE-288

Public exploit & PoC references

https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx

All references

https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx
https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-sni-check-bypass-via-http-2-scheme

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100261
MEDIUMCVE-2026-100518
CRITICALCVE-2026-104075
MEDIUMCVE-2026-106601
MEDIUMCVE-2026-106602
UNSCOREDCVE-2026-107194
MEDIUMCVE-2026-107361PoC
CRITICALCVE-2026-107656

Related by shared AI tags and CWE weakness class. Browse the full archive.