V2: Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass (CVE-2026-48491)

Traefik's SNICheck middleware fails to apply wildcard matching when resolving TLS options for HTTP Host headers, relying solely on exact map lookups. When a router uses a wildcard host rule (e.g., Host(`*.example.com`)) with strict TLSOptions such as RequireAndVerifyClientCert, SNICheck incorrectly classifies requests as using default TLS options if the HTTP Host header matches the wildcard domain but the TLS SNI matches a permissive domain on the same entrypoint. This allows an unauthenticated client to bypass mutual TLS authentication by completing the TLS handshake with a permissive SNI and then sending an HTTP Host header targeting the wildcard-protected backend. The vulnerability affects Traefik versions prior to 2.11.48 and versions 3.7.0 up to but not including 3.7.3. The issue does not require HTTP/3 and impacts HTTPS and HTTP/2 paths. The vendor has released a patch in version 3.7.3 to address this flaw.

An unauthenticated attacker can bypass mutual TLS authentication enforced by Traefik on wildcard host routes, gaining unauthorized access to backend services that require client certificates. This undermines critical access controls and confidentiality protections, potentially exposing sensitive data or services to unauthorized users. The vulnerability does not affect availability but has high confidentiality and integrity impact.

A patch is available in Traefik version 3.7.3 and later; upgrading to this version or newer is the recommended remediation. Alternatively, avoid configuring Traefik with wildcard host rules using strict TLSOptions such as RequireAndVerifyClientCert on entrypoints that also serve permissive SNI configurations. Restricting network access to Traefik's entrypoints to trusted networks can also reduce exposure. Follow the vendor advisory and update accordingly.