Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate… (CVE-2026-85597)
Description
Traefik versions prior to 2.11.55 have a vulnerability in TLS option conflict resolution that allows unauthenticated attackers to bypass client-certificate authentication. This occurs when conflicting TLS options are configured on multi-host routers, enabling attackers to access protected backends by exploiting shared TLS resolution across multiple hostnames within a single router rule. The strict mutual TLS (mTLS) requirement can fall back to default options, weakening security controls.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Traefik before version 2.11.55 involves improper handling of TLS option conflicts on multi-host routers. Attackers can create conflicting TLS options that cause the router to apply default TLS settings instead of enforcing strict client-certificate authentication (mTLS). This bypass allows unauthenticated access to backends that should be protected by client certificates. The issue arises from shared TLS resolution logic across multiple hostnames in a single router rule, leading to a failure in enforcing intended authentication policies.
Potential Impact
Unauthenticated attackers can bypass client-certificate authentication and gain unauthorized access to backend services protected by Traefik's mTLS enforcement. This undermines the security of services relying on strict client authentication, potentially exposing sensitive resources to unauthorized parties.
Mitigation Recommendations
A fix is available in Traefik version 2.11.55. Users should upgrade to version 2.11.55 or later to remediate this vulnerability. No additional mitigation guidance is provided in the available data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q42x-32f8-m4r5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-85597"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a9ad4d2acd9273b49b664f0
Added to database: 09/04/2026, 14:25:22 UTC
Last enriched: 09/07/2026, 16:37:39 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.