AIKIDO-2026-418503

github.com/traefik/traefik/v3 is vulnerable to Incorrect Authorization

Incorrect AuthorizationCVE-2026-85597 Published 2 days ago

High Risk

This Affects:

github.com/traefik/traefik/v3

3.0.0 - 3.7.10

Fixed in 3.7.11

Are you affected? Scan for Free

TL;DR

TLS options are mapped to hostnames of a router rule rather than to the router itself, so a TLS option conflict on one host of a multi-host router falls back to default TLS options for every host in that rule. A host that requires client-certificate authentication can stop enforcing mTLS when another host in the same rule conflicts, letting clients without certificates reach the protected backend. The fix adds the core.strictTLSOptions static option, which disables that fallback and marks conflicting routers as errors instead.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and use multi-host routers where one host requires client-certificate authentication while another host can create a TLS option conflict.

Background info

github.com/traefik/traefik/v3 is vulnerable to Incorrect Authorization in versions 3.0.0 - 3.7.10.

How to fix this

Upgrade the github.com/traefik/traefik/v3 library to the patch version and enable core.strictTLSOptions; alternatively, ensure all routers serving the same host on an entrypoint reference identical TLS options.

High Risk