CVE-2026-85597

Red Hat statement

A flaw was found in Traefik before v2.11.55 and v3.0.0 through v3.7.10, where multi-host router configurations fail to isolate TLS options. When shared router rules encompass multiple hostnames, conflicting TLS settings cause strict mTLS enforcement to regress to default configuration parameters across all associated endpoints. Within Red Hat environments utilizing affected Traefik versions, an unauthenticated remote attacker can exploit this fallback behavior to bypass client-certificate authentication controls and access protected backend services without valid credentials.

Red Hat mitigation

Separate multi-host router rules into dedicated single-host routers so each domain explicitly defines its required TLS options without inheritance conflicts. Alternatively, enforce client-certificate authentication at an upstream ingress controller or API gateway before traffic reaches the Traefik router.