Description (CNA)
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host() creates a TLS options conflict that falls back to the default options.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| traefik / traefik | affected 0 before 2.11.58; unaffected 2.11.58 |
| traefik / traefik | affected 3.0.0 before 3.7.13; unaffected 3.7.13 |
CWE
CWE-436